# CVEs published 2025-03-05

139 CVEs were published on March 5, 2025: 50 critical, 29 high. Days are UTC.

- [CVE-2025-27625](https://cve.now/CVE-2025-27625.md): In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (\`\\\`) characters are considered safe, allowing atta (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-27624](https://cve.now/CVE-2025-27624.md): A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggl (CVSS 5.4, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-27623](https://cve.now/CVE-2025-27623.md): Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing \`config.xml\` of views via REST (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-27622](https://cve.now/CVE-2025-27622.md): Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing \`config.xml\` of agents via RES (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-27508](https://cve.now/CVE-2025-27508.md): Emissary Use of a Broken or Risky Cryptographic Algorithm (CVSS 7.5, NationalSecurityAgency emissary · gov.nsa.emissary:emissary)
- [CVE-2025-27516](https://cve.now/CVE-2025-27516.md): Jinja sandbox breakout through attr filter selecting format method (CVSS 5.4, pallets jinja · jinja2)
- [CVE-2025-27517](https://cve.now/CVE-2025-27517.md): Volt Allows RCE Via User-Crafted Requests (CVSS 9.3, livewire volt · livewire/volt)
- [CVE-2025-2003](https://cve.now/CVE-2025-2003.md): Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' p (CVSS 7.1, Devolutions Server)
- [CVE-2025-27515](https://cve.now/CVE-2025-27515.md): Laravel has a File Validation Bypass (CVSS 6.9, laravel framework · laravel/framework)
- [CVE-2025-27513](https://cve.now/CVE-2025-27513.md): OpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API Package (CVSS 7.5, open-telemetry opentelemetry-dotnet · OpenTelemetry.Api)
- [CVE-2024-11035](https://cve.now/CVE-2024-11035.md): Carbon Black Cloud Windows Sensor Information Leak (CVSS 2.5, Symantec Carbon Black Cloud Windows Sensor)
- [CVE-2025-20208](https://cve.now/CVE-2025-20208.md): A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote atta (CVSS 4.6, Cisco TelePresence Management Suite)
- [CVE-2025-20206](https://cve.now/CVE-2025-20206.md): Cisco Secure Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability (CVSS 7.1, Cisco Secure Client)
- [CVE-2025-27497](https://cve.now/CVE-2025-27497.md): OpenDJ Denial of Service (Dos) using alias loop (CVSS 8.7, OpenIdentityPlatform OpenDJ · org.openidentityplatform.open…)
- [CVE-2025-27412](https://cve.now/CVE-2025-27412.md): REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation (CVSS 6.1, redaxo · redaxo/source)
- [CVE-2025-27411](https://cve.now/CVE-2025-27411.md): REDAXO allows Arbitrary File Upload in the mediapool page (CVSS 5.4, redaxo · redaxo/source)
- [CVE-2023-38693](https://cve.now/CVE-2023-38693.md): RCE in Lucee REST endpoint (CVSS 9.8, Lucee · org.lucee:lucee)
- [CVE-2025-23416](https://cve.now/CVE-2025-23416.md): Keysight Ixia Vision Product Family Path Traversal (CVSS 4.9, Keysight Ixia Vision Product Family)
- [CVE-2025-21095](https://cve.now/CVE-2025-21095.md): Keysight Ixia Vision Product Family Path Traversal (CVSS 4.9, Keysight Ixia Vision Product Family)
- [CVE-2025-24521](https://cve.now/CVE-2025-24521.md): Keysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference (CVSS 4.9, Keysight Ixia Vision Product Family)
- [CVE-2025-22212](https://cve.now/CVE-2025-22212.md): Extension - tassos.gr - SQL injection in Convert Forms component version 1.0.0-1.0.0 - 4.4.9 for Joomla (CVSS 2.7, tassos.gr Convert Forms component for Joomla)
- [CVE-2025-24494](https://cve.now/CVE-2025-24494.md): Keysight Ixia Vision Product Family Path Traversal (CVSS 7.2, Keysight Ixia Vision Product Family)
- [CVE-2025-1714](https://cve.now/CVE-2025-1714.md): Username Enumeration in Gliffy (CVSS 6.9, Perforce Gliffy)
- [CVE-2024-12799](https://cve.now/CVE-2024-12799.md): Insufficiently Protected Credentials (CVSS 10.0, OpenText Identity Manager Advanced Edition)
- [CVE-2024-13147](https://cve.now/CVE-2024-13147.md): SQLi in Merkur Software's B2B Login Panel (CVSS 9.8, Merkur Software B2B Login Panel)
- [CVE-2024-12097](https://cve.now/CVE-2024-12097.md): SQLi in Boceksoft Informatics' E-Travel (CVSS 9.8, Boceksoft Informatics E-Travel)
- [CVE-2024-11216](https://cve.now/CVE-2024-11216.md): Broken Access Control in PozitifIK's Pik Online (CVSS 7.6, PozitifIK Pik Online)
- [CVE-2024-12650](https://cve.now/CVE-2024-12650.md): Wago: Vulnerability in libwagosnmp (CVSS 5.4, WAGO CC100 0751-9x01 · WAGO Edge Controller 0752-8303/8… +10)
- [CVE-2024-11153](https://cve.now/CVE-2024-11153.md): Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More \<= 2.5.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3, danieliser Content Control – The Ultimate Content Restricti…)
- [CVE-2024-11951](https://cve.now/CVE-2024-11951.md): Homey Login Register \<= 2.4.0 - Unauthenticated Privilege Escalation in homey\_register (CVSS 9.8, Fave Themes Homey Login Register)
- [CVE-2024-12281](https://cve.now/CVE-2024-12281.md): Homey \<= 2.4.2 - Unauthenticated Privilege Escalation in homey\_save\_profile (CVSS 9.8, Fave Themes Homey)
- [CVE-2025-1702](https://cve.now/CVE-2025-1702.md): Ultimate Member \<= 2.10.0 - Unauthenticated SQL Injection via search Parameter (CVSS 7.5, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2024-13423](https://cve.now/CVE-2024-13423.md): Sparkling \<= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivation (CVSS 5.3, silkalns Sparkling)
- [CVE-2024-13471](https://cve.now/CVE-2024-13471.md): DesignThemes Core Features \<= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt\_process\_imported\_file (CVSS 7.5, DesignThemes Core Features)
- [CVE-2025-1463](https://cve.now/CVE-2025-1463.md): Spreadsheet Integration \<= 3.8.2 - Cross-Site Request Forgery to Arbitrary Post Publish (CVSS 4.3, javmah WPGSI: Spreadsheet Integration)
- [CVE-2025-25015](https://cve.now/CVE-2025-25015.md): Kibana arbitrary code execution via prototype pollution (CVSS 9.9, Elastic Kibana)
- [CVE-2024-13232](https://cve.now/CVE-2024-13232.md): WordPress Awesome Import & Export Plugin - Import & Export WordPress Data \<= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Execution/Privilege Escalation (CVSS 8.8, ddeveloper WordPress Awesome Import & Export Plugin - Impor…)
- [CVE-2024-11731](https://cve.now/CVE-2024-11731.md): Master Slider – Responsive Touch Slider \<= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms\_slider Shortcode (CVSS 6.4, averta Master Slider – Responsive Touch Slider)
- [CVE-2024-13747](https://cve.now/CVE-2024-13747.md): WooMail - WooCommerce Email Customizer \<= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection (CVSS 4.3, CidCode WooMail - WooCommerce Email Customizer)
- [CVE-2024-13815](https://cve.now/CVE-2024-13815.md): Listingo - Business Listing and Directory WordPress Theme \<= 3.2.7 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, Themographics Listingo)
- [CVE-2024-13810](https://cve.now/CVE-2024-13810.md): Zass - WooCommerce Theme for Handmade Artists and Artisans \<= 3.9.9.10 - Missing Authorization to Authenticated (Subscriber+) Demo Import (CVSS 4.3, AlThemist Zass - WooCommerce Theme for Handmade Artists and…)
- [CVE-2024-13787](https://cve.now/CVE-2024-13787.md): VEDA - MultiPurpose WordPress Theme \<= 4.2 - Authenticated (Subscriber+) PHP Object Injection (CVSS 9.8, designthemes VEDA - MultiPurpose WordPress Theme)
- [CVE-2024-12815](https://cve.now/CVE-2024-12815.md): Point Maker \<= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, zipang Point Maker)
- [CVE-2024-13809](https://cve.now/CVE-2024-13809.md): Hero Slider - WordPress Slider Plugin \<= 1.3.5 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, heroplugins Hero Slider - WordPress Slider Plugin)
- [CVE-2025-1515](https://cve.now/CVE-2025-1515.md): WP Real Estate Manager \<= 2.8 - Authentication Bypass via Account Takeover (CVSS 9.8, Chimpstudio WP Real Estate Manager)
- [CVE-2024-13839](https://cve.now/CVE-2024-13839.md): Company Directory \<= 4.3 - Reflected Cross-Site Scripting via add\_query\_arg Function (CVSS 6.1, richardgabriel Staff Directory Plugin: Company Directory)
- [CVE-2025-0954](https://cve.now/CVE-2025-0954.md): WP Online Contract \<= 5.1.4 - Missing Authorization to Unauthenticated Settings Import (CVSS 6.5, futuredesigngrp WP Online Contract)
- [CVE-2024-13778](https://cve.now/CVE-2024-13778.md): Hero Mega Menu - Responsive WordPress Menu Plugin \<= 1.16.5 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, heroplugins Hero Mega Menu - Responsive WordPress Menu Plug…)
- [CVE-2024-13811](https://cve.now/CVE-2024-13811.md): Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme \<= 4.5.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import (CVSS 4.3, AlThemist Lafka - Multi Store Burger - Pizza & Food Deliver…)
- [CVE-2024-5667](https://cve.now/CVE-2024-5667.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library (CVSS 6.4, cipherdevgroup WP Featherlight – A Simple jQuery Lightbox ·…)
- [CVE-2024-13757](https://cve.now/CVE-2024-13757.md): Master Slider – Responsive Touch Slider \<= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms\_layer Shortcode (CVSS 6.4, averta Master Slider – Responsive Touch Slider)
- [CVE-2024-13777](https://cve.now/CVE-2024-13777.md): ZoomSounds - WordPress Wave Audio Player with Playlist \<= 6.91 - Unauthenticated PHP Object Injection (CVSS 8.1, ZoomIt ZoomSounds - WordPress Wave Audio Player with Playli…)
- [CVE-2024-13779](https://cve.now/CVE-2024-13779.md): Hero Mega Menu - Responsive WordPress Menu Plugin \<= 1.16.5 - Reflected Cross-Site Scripting (CVSS 6.1, heroplugins Hero Mega Menu - Responsive WordPress Menu Plug…)
- [CVE-2024-13780](https://cve.now/CVE-2024-13780.md): Hero Mega Menu - Responsive WordPress Menu Plugin \<= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Directory Deletion (CVSS 6.5, heroplugins Hero Mega Menu - Responsive WordPress Menu Plug…)
- [CVE-2025-0956](https://cve.now/CVE-2025-0956.md): WooCommerce Recover Abandoned Cart \<= 24.4.0 - Unauthenticated PHP Object Injection (CVSS 8.1, FantasticPlugins WooCommerce Recover Abandoned Cart)
- [CVE-2025-22493](https://cve.now/CVE-2025-22493.md): Improper cookie attributes in Foreseer Reporting Software (FRS) (CVSS 5.6, Eaton Foreseer Reporting Software)
- [CVE-2024-13866](https://cve.now/CVE-2024-13866.md): Simple Notification \<= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 6.4, appsbd Simple Notification)
- [CVE-2025-1008](https://cve.now/CVE-2025-1008.md): Recently Purchased Products For Woo \<= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameter (CVSS 6.4, worldweb Recently Purchased Products For Woo)
- [CVE-2024-13827](https://cve.now/CVE-2024-13827.md): Razorpay Subscription Button Elementor Plugin \<= 1.0.3 - Reflected Cross-Site Scripting via add\_query\_arg and remove\_query\_arg Functions (CVSS 6.1, Razorpay Subscription Button Elementor Plugin)
- [CVE-2024-13350](https://cve.now/CVE-2024-13350.md): SearchIQ – The Search Solution \<= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, SearchIQ – The Search Solution)
- [CVE-2024-8682](https://cve.now/CVE-2024-8682.md): JNews - WordPress Newspaper Magazine Blog AMP Theme \<= 11.6.6 - Unauthorized User Registration (CVSS 5.3, https://themeforest.net/item/jnews-one-stop-solution-for-we…)
- [CVE-2025-0990](https://cve.now/CVE-2025-0990.md): I Am Gloria \<= 1.1.4 - Cross-Site Request Forgery (CVSS 4.3, webtroniclabs I Am Gloria)
- [CVE-2025-1435](https://cve.now/CVE-2025-1435.md): bbPress \<= 2.6.11 - Cross-Site Request Forgery to Limited Privilege Escalation (CVSS 6.3, johnjamesjacoby bbPress)
- [CVE-2025-1393](https://cve.now/CVE-2025-1393.md): Weidmueller: Authentication Vulnerability due to Hard-coded Credentials (CVSS 9.8, Weidmueller PROCON-WIN)
- [CVE-2025-1923](https://cve.now/CVE-2025-1923.md): Inappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to insta (CVSS 4.3, Google Chrome)
- [CVE-2025-1922](https://cve.now/CVE-2025-1922.md): Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user (CVSS 4.3, Google Chrome)
- [CVE-2025-1921](https://cve.now/CVE-2025-1921.md): Inappropriate implementation in Media Stream in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to obtain information about a (CVSS 6.5, Google Chrome)
- [CVE-2025-1919](https://cve.now/CVE-2025-1919.md): Out of bounds read in Media in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory ac (CVSS 8.8, Google Chrome)
- [CVE-2025-1918](https://cve.now/CVE-2025-1918.md): Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory a (CVSS 8.8, Google Chrome)
- [CVE-2025-1917](https://cve.now/CVE-2025-1917.md): Inappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofi (CVSS 4.3, Google Chrome)
- [CVE-2025-1916](https://cve.now/CVE-2025-1916.md): Use after free in Profiles in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension (CVSS 8.8, Google Chrome)
- [CVE-2025-1915](https://cve.now/CVE-2025-1915.md): Improper Limitation of a Pathname to a Restricted Directory in DevTools in Google Chrome on Windows prior to 134.0.6998.35 allowed an attack (CVSS 8.1, Google Chrome)
- [CVE-2025-1914](https://cve.now/CVE-2025-1914.md): Out of bounds read in V8 in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to perform out of bounds memory access via a craf (CVSS 8.8, Google Chrome)
- [CVE-2025-1967](https://cve.now/CVE-2025-1967.md): code-projects Blood Bank Management System donor.php cross site scripting (CVSS 5.1, code-projects Blood Bank Management System)
- [CVE-2024-0114](https://cve.now/CVE-2024-0114.md): NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administra (CVSS 8.1, NVIDIA Hopper HGX 8-GPU)
- [CVE-2024-0141](https://cve.now/CVE-2024-0141.md): NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the GPU vBIOS that may allow a malicious actor with tenant level GPU access to write (CVSS 6.8, NVIDIA Hopper HGX 8-GPU)
- [CVE-2025-1966](https://cve.now/CVE-2025-1966.md): PHPGurukul Pre-School Enrollment System index.php sql injection (CVSS 6.9, PHPGurukul Pre-School Enrollment System)
- [CVE-2025-1965](https://cve.now/CVE-2025-1965.md): projectworlds Online Hotel Booking login.php sql injection (CVSS 6.9, projectworlds Online Hotel Booking)
- [CVE-2025-1964](https://cve.now/CVE-2025-1964.md): projectworlds Online Hotel Booking booknow.php sql injection (CVSS 6.9, projectworlds Online Hotel Booking)
- [CVE-2025-20002](https://cve.now/CVE-2025-20002.md): GMOD Apollo Generation of Error Message Containing Sensitive Information (CVSS 6.9, GMOD Apollo)
- [CVE-2025-24924](https://cve.now/CVE-2025-24924.md): GMOD Apollo Missing Authentication for Critical Function (CVSS 9.3, GMOD Apollo)
- [CVE-2025-1963](https://cve.now/CVE-2025-1963.md): projectworlds Online Hotel Booking reservation.php sql injection (CVSS 6.9, projectworlds Online Hotel Booking)
- [CVE-2024-31525](https://cve.now/CVE-2024-31525.md): Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. (CVSS 7.2)
- [CVE-2024-48246](https://cve.now/CVE-2024-48246.md): Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/book (CVSS 5.4)
- [CVE-2024-51144](https://cve.now/CVE-2024-51144.md): Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add\_message', pvmsg.php?action=confirm\_delete , and ajax.ser (CVSS 8.8)
- [CVE-2024-53458](https://cve.now/CVE-2024-53458.md): Sysax Multi Server 6.99 is vulnerable to a denial of service (DoS) condition when processing specially crafted SSH packets. (CVSS 7.5)
- [CVE-2024-57174](https://cve.now/CVE-2024-57174.md): A misconfiguration in Alphion ASEE-1443 Firmware v0.4.H.00.02.15 defines a previously unregistered domain name as the default DNS suffix. (CVSS 8.1)
- [CVE-2025-25362](https://cve.now/CVE-2025-25362.md): A Server-Side Template Injection (SSTI) vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via injecting a crafted (CVSS 9.8, spacy-llm)
- [CVE-2025-25632](https://cve.now/CVE-2025-25632.md): Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet. (CVSS 9.8)
- [CVE-2025-25634](https://cve.now/CVE-2025-25634.md): A vulnerability has been found in Tenda AC15 15.03.05.19 in the function GetParentControlInfo of the file /goform/GetParentControlInfo. (CVSS 6.5)
- [CVE-2025-27637](https://cve.now/CVE-2025-27637.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Cross-Site Scripting V-2024-016. (CVSS 6.1)
- [CVE-2025-27638](https://cve.now/CVE-2025-27638.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Hardcoded Password V-2024-013. (CVSS 9.8)
- [CVE-2025-27639](https://cve.now/CVE-2025-27639.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Privilege Escalation V-2024-015. (CVSS 8.8)
- [CVE-2025-27640](https://cve.now/CVE-2025-27640.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows SQL Injection V-2024-012. (CVSS 9.8)
- [CVE-2025-27641](https://cve.now/CVE-2025-27641.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.951 Application 20.0.2368 allows Unauthenticated APIs for Single-Sig (CVSS 9.8)
- [CVE-2025-27642](https://cve.now/CVE-2025-27642.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Unauthenticated Driver Package Edit (CVSS 9.8)
- [CVE-2025-27643](https://cve.now/CVE-2025-27643.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Hardcoded AWS API Key V-2024-006. (CVSS 9.8)
- [CVE-2025-27644](https://cve.now/CVE-2025-27644.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Local Privilege Escalation V-2024-0 (CVSS 7.8)
- [CVE-2025-27645](https://cve.now/CVE-2025-27645.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Insecure Extension Installation by (CVSS 9.8)
- [CVE-2025-27646](https://cve.now/CVE-2025-27646.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Edit User Account Exposure V-2024-0 (CVSS 9.8)
- [CVE-2025-27647](https://cve.now/CVE-2025-27647.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Addition of Partial Admin Users Wit (CVSS 9.8)
- [CVE-2025-27648](https://cve.now/CVE-2025-27648.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Cross Tenant Password Exposure V-20 (CVSS 9.8)
- [CVE-2025-27649](https://cve.now/CVE-2025-27649.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.893 Application 20.0.2140 allows Incorrect Access Control: PHP V-202 (CVSS 9.8)
- [CVE-2025-27650](https://cve.now/CVE-2025-27650.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Private Keys in Docker Overlay V-20 (CVSS 9.8)
- [CVE-2025-27651](https://cve.now/CVE-2025-27651.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: Elatec (CVSS 9.8)
- [CVE-2025-27652](https://cve.now/CVE-2025-27652.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: rfIDEA (CVSS 9.8)
- [CVE-2025-27653](https://cve.now/CVE-2025-27653.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Preauthenticated Cross Site Scripti (CVSS 6.1)
- [CVE-2025-27654](https://cve.now/CVE-2025-27654.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Cross Site Scripting (XSS) V-2023-0 (CVSS 6.1)
- [CVE-2025-27655](https://cve.now/CVE-2025-27655.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: CPA v1 (CVSS 9.8)
- [CVE-2025-27656](https://cve.now/CVE-2025-27656.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2 (CVSS 9.8)
- [CVE-2025-27657](https://cve.now/CVE-2025-27657.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Code Execution V-2023-008. (CVSS 9.8)
- [CVE-2025-27658](https://cve.now/CVE-2025-27658.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Authentication Bypass OVE-20230524- (CVSS 9.8)
- [CVE-2025-27659](https://cve.now/CVE-2025-27659.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows SQL Injection OVE-20230524-0002. (CVSS 9.8)
- [CVE-2025-27660](https://cve.now/CVE-2025-27660.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross Site Scripting OVE-20230524-0 (CVSS 5.4)
- [CVE-2025-27661](https://cve.now/CVE-2025-27661.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004. (CVSS 9.1)
- [CVE-2025-27662](https://cve.now/CVE-2025-27662.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005. (CVSS 9.8)
- [CVE-2025-27663](https://cve.now/CVE-2025-27663.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Weak Password Encryption / Encoding (CVSS 9.8)
- [CVE-2025-27664](https://cve.now/CVE-2025-27664.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient CSRF Protection OVE-20 (CVSS 8.8)
- [CVE-2025-27665](https://cve.now/CVE-2025-27665.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Antivirus Protection a (CVSS 9.8)
- [CVE-2025-27666](https://cve.now/CVE-2025-27666.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Authorization Checks O (CVSS 9.8)
- [CVE-2025-27667](https://cve.now/CVE-2025-27667.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumerati (CVSS 9.8)
- [CVE-2025-27668](https://cve.now/CVE-2025-27668.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Arbitrary Content Inclusion via Ifr (CVSS 9.8)
- [CVE-2025-27669](https://cve.now/CVE-2025-27669.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Network Scanning (XSPA)/DoS (CVSS 7.5)
- [CVE-2025-27670](https://cve.now/CVE-2025-27670.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Signature Validation O (CVSS 9.8)
- [CVE-2025-27671](https://cve.now/CVE-2025-27671.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Device Impersonation OVE-20230524-0 (CVSS 9.8)
- [CVE-2025-27672](https://cve.now/CVE-2025-27672.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows OAUTH Security Bypass OVE-20230524- (CVSS 9.8)
- [CVE-2025-27673](https://cve.now/CVE-2025-27673.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cookie Returned in Response Body OV (CVSS 9.1)
- [CVE-2025-27674](https://cve.now/CVE-2025-27674.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP Key V-2023-006. (CVSS 9.8)
- [CVE-2025-27675](https://cve.now/CVE-2025-27675.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable OpenID Implementation V- (CVSS 9.8)
- [CVE-2025-27676](https://cve.now/CVE-2025-27676.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Reports V-2 (CVSS 6.1)
- [CVE-2025-27677](https://cve.now/CVE-2025-27677.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Symbolic Links For Unprivileged Fil (CVSS 9.8)
- [CVE-2025-27678](https://cve.now/CVE-2025-27678.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Client Remote Code Execution V-2023 (CVSS 9.8)
- [CVE-2025-27679](https://cve.now/CVE-2025-27679.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Badge Regis (CVSS 6.1)
- [CVE-2025-27680](https://cve.now/CVE-2025-27680.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.750 Application 20.0.1442 allows Insecure Firmware Image with Insuffi (CVSS 9.1)
- [CVE-2025-27681](https://cve.now/CVE-2025-27681.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 mishandles Client Inter-process Security V- (CVSS 9.8)
- [CVE-2025-27682](https://cve.now/CVE-2025-27682.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Insecure Log Permissions V-2022-005. (CVSS 9.8)
- [CVE-2025-27683](https://cve.now/CVE-2025-27683.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Driver Unrestricted Upload of File w (CVSS 8.8)
- [CVE-2025-27684](https://cve.now/CVE-2025-27684.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Debug Bundle Contains Sensitive Data (CVSS 7.5)
- [CVE-2025-27685](https://cve.now/CVE-2025-27685.md): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Configuration File Contains CA & Pri (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.