CVEs published March 7, 2025
112 CVEs were published on March 7, 2025: 7 critical, 30 high.
- Published
- 112
- Critical
- 7
- High
- 30
- Medium
- 64
- Low
- 7
- Unrated
- 4
- Now in CISA KEV
- 0
- Fix available
- 39
Most affected products
- Linux
- 8
- QNAP Systems QTS · QNAP Systems QuTS hero
- 8
- projectworlds Life Insurance Management System
- 6
- dasinfomedia School Management System for Wordpress
- 5
- PHPGurukul Emergency Ambulance Hiring Portal
- 4
- StarSea99 starsea-mall
- 4
- TOTOLINK EX1800T
- 4
- PHPGurukul Apartment Visitors Management System
- 3
- Chimpstudio CS Framework
- 2
- Fave Themes Homey
- 2
Critical 7
- CVE-2025-27603XWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translationsxwikisas application-confluence-migrator-pro · com.xwiki.co…
- CVE-2025-27519Cognita Arbitrary File Writetruefoundry cognita
- CVE-2024-12876Golo - Directory & Listing, Travel WordPress Theme <= 1.6.10 - Missing Authorization to Privilege Escalation via Unauthenticated Arbitrary User Password Changeuxper Golo - City Travel Guide WordPress Theme
- CVE-2025-1315InWave Jobs <= 3.5.1 - Unauthenticated Privilege Escalation via Password Resetsfwebservice InWave Jobs
- CVE-2025-1475WPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone'whyun WPCOM Member
- CVE-2024-42733An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script to the UNC path inpu
- CVE-2025-27816A vulnerability was discovered in the Arctera InfoScale 7.0 through 8.0.2 where a .NET remoting endpoint can be exploited due to the insecur
High 30
- CVE-2025-2097TOTOLINK EX1800T cstecgi.cgi setRptWizardCfg stack-based overflowTOTOLINK EX1800T
- CVE-2025-2024Trimble SketchUp SKP File Parsing Uninitialized Variable Remote Code Execution VulnerabilityTrimble SketchUp
- CVE-2025-0162IBM Aspera Shares XML external entity injectionIBM Aspera Shares
- CVE-2025-27607Python JSON Logger has a Potential RCE via missing `msgspec-python313-pre` dependencynhairs python-json-logger
- CVE-2024-53694QVPN Device Client, Qsync, Qfinder ProQNAP Systems QVPN Device Client for Mac · QNAP Systems Q… +1
- CVE-2024-53693QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-50394HelpdeskQNAP Systems Helpdesk
- CVE-2024-50390QHoraQNAP Systems QuRouter
- CVE-2025-27604XWiki Confluence Migrator Pro's homepage is publicxwikisas application-confluence-migrator-pro · com.xwiki.co…
- CVE-2025-27597Vue I18n Prototype Pollution in `handleFlatJson`intlify vue-i18n · @intlify/message-resolver +5
- CVE-2025-27152Possible SSRF and Credential Leakage via Absolute URL in axios Requestsaxios
- CVE-2025-1887SMB forced authentication vulnerability in Sage 200 SpainSage 200 Spain
- CVE-2025-1886Pass-Back vulnerability in Sage 200 SpainSage 200 Spain
- CVE-2024-13668WordPress Activity O Meter <= 1 - Reflected XSSWordPress Activity O Meter
- CVE-2025-21842amdkfd: properly free gang_ctx_bo when failed to init user queueLinux
- CVE-2025-21839KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loopLinux
- CVE-2025-21836io_uring/kbuf: reallocate buf lists on upgradeLinux
- CVE-2025-0959Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_idimithemes Eventer - WordPress Event & Booking Manager Plugin
- CVE-2024-9658School Management System for Wordpress <= 93.0.0 - Authenticated (Student+) Account Takeover and Privilege Escalationdasinfomedia School Management System for Wordpress
- CVE-2024-12036CS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File ReadChimpstudio CS Framework
- CVE-2024-10804Ultimate Video Player <= 10.0 - Unauthenticated Arbitrary File DownloadFWDesign Ultimate Video Player WordPress & WooCommerce Plug…
- CVE-2024-12035CS Framework <= 7.0 - Authenticated (Subscriber+) Arbitrary File DeletionChimpstudio CS Framework
- CVE-2025-26331Dell ThinOS 2411 and prior, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability.Dell Wyse Proprietary OS
- CVE-2024-12837GPU DDK - Exploitable kernel double free on apsFenceSyncCheckpoints allocated with arbitrary sizeImagination Technologies Graphics DDK
- CVE-2024-13906Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.3 - Authenticated (Administrator+) PHP Object InjectionGallery by BestWebSoft – Customizable Image and Photo Galle…
- CVE-2025-1309UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.04 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Updateadmintwentytwenty UiPress lite | Effortless custom dashboar…
- CVE-2024-13320CURCY - WooCommerce Multi Currency - Currency Switcher <= 2.3.6 - Unauthenticated SQL Injectionvillatheme CURCY - WooCommerce Multi Currency - Currency Sw…
- CVE-2024-13655Flex Mag - Responsive WordPress News Theme <= 3.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option DeletionMVPThemes Flex Mag - Responsive WordPress News Theme
- CVE-2025-0749Homey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value CheckFave Themes Homey
- CVE-2025-27822An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS.backdropcms Masquerade
Medium, low and unrated 75
- CVE-2025-2096TOTOLINK EX1800T cstecgi.cgi setRebootScheCfg os command injectionTOTOLINK EX1800T
- CVE-2025-2095TOTOLINK EX1800T cstecgi.cgi setDmzCfg os command injectionTOTOLINK EX1800T
- CVE-2025-2094TOTOLINK EX1800T cstecgi.cgi setWiFiExtenderConfig os command injectionTOTOLINK EX1800T
- CVE-2025-2093PHPGurukul Online Library Management System change-password.php password recoveryPHPGurukul Online Library Management System
- CVE-2025-26643Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2023-43052IBM Control Center external service interactionIBM Control Center
- CVE-2023-35894IBM Control Center HOST header injectionIBM Control Center
- CVE-2024-12975Silicon Labs CPC can leak information in full duplex SPISilicon Labs Simplicity SDK
- CVE-2024-53700QHoraQNAP Systems QuRouter
- CVE-2024-53699QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-53698QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-53697QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-53696QuLog CenterQNAP Systems QuLog Center · QNAP Systems QTS +1
- CVE-2024-53695HBS 3 Hybrid Backup SyncQNAP Systems HBS 3 Hybrid Backup Sync
- CVE-2024-53692QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-50405QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-48864File Station 5QNAP Systems File Station
- CVE-2024-38638QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-13086QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-27518Cognita CORS misconfiguration in backend API servertruefoundry cognita
- CVE-2025-2090PHPGurukul Pre-School Enrollment System Sub Admin add-subadmin.php access controlPHPGurukul Pre-School Enrollment System
- CVE-2025-2089StarSea99 starsea-mall com.siro.mall.controller.mall.UserController updateInfo updateUserInfo access controlStarSea99 starsea-mall
- CVE-2025-2088PHPGurukul Pre-School Enrollment System profile.php sql injectionPHPGurukul Pre-School Enrollment System
- CVE-2025-2087StarSea99 starsea-mall update cross site scriptingStarSea99 starsea-mall
- CVE-2025-2086StarSea99 starsea-mall update cross site scriptingStarSea99 starsea-mall
- CVE-2025-2085StarSea99 starsea-mall save cross site scriptingStarSea99 starsea-mall
- CVE-2025-2084PHPGurukul Human Metapneumovirus Testing Management System Search Report Page search-report.php cross site scriptingPHPGurukul Human Metapneumovirus Testing Management System
- CVE-2024-12634Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins <= 2.0.59 - Cross-Site Request Forgery to Stored Cross-Site ScriptingRelated Posts, Inline Related Posts, Contextual Related Pos…
- CVE-2025-1768SEO Plugin by Squirrly SEO <= 12.4.05 - Authenticated (Subscriber+) SQL Injection via search Parametercifi SEO Plugin by Squirrly SEO
- CVE-2024-9458Reservit Hotel < 3.0 - Admin+ Stored XSSReservit Hotel
- CVE-2024-13857WPGet API <= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgerydavidanderson WPGet API – Connect to any external REST API
- CVE-2024-13635VK Blocks <= 1.94.2.2 - Missing Authorization to Sensitive Information Exposurevektor-inc VK Blocks
- CVE-2024-13552SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Referencepsmplugins SupportCandy – Helpdesk & Customer Support Ticke…
- CVE-2024-13805Advanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploadsaadiqbal Advanced File Manager – Ultimate File Manager for…
- CVE-2025-21843drm/panthor: avoid garbage value in panthor_ioctl_dev_query()Linux
- CVE-2025-21841cpufreq/amd-pstate: Fix cpufreq_policy ref countingLinux
- CVE-2025-21840thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI headerLinux
- CVE-2025-21838usb: gadget: core: flush gadget workqueue after device removalLinux
- CVE-2025-21835usb: gadget: f_midi: fix MIDI Streaming descriptor lengthsLinux
- CVE-2024-13431Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scriptingcroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2024-12609School Management System for Wordpress <= 92.0.0 - Authenticated (Student+) SQL Injection via 'view-attendance'dasinfomedia School Management System for Wordpress
- CVE-2024-12610School Management System for Wordpress <= 93.0.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletiondasinfomedia School Management System for Wordpress
- CVE-2024-13904Platform.ly for WooCommerce <= 1.1.6 - Unauthenticated Blind Server-Side Request Forgeryplatformlycom Platform.ly for WooCommerce
- CVE-2024-13781Hero Maps Premium - Customizable Google Maps Plugin <= 2.3.9 - Authenticated (Subscriber+) SQL InjectionHero Plugins Hero Maps Premium
- CVE-2024-12611School Management System for Wordpress <= 93.0.0 - Reflected Cross-Site Scriptingdasinfomedia School Management System for Wordpress
- CVE-2024-12607School Management System for Wordpress <= 92.0.0 - Authenticated (Subscriber+) SQL Injection via 'mj_smgt_show_event_task'dasinfomedia School Management System for Wordpress
- CVE-2024-12576GPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned addressImagination Technologies Graphics DDK
- CVE-2025-0863Flexmls® IDX <= 3.14.27 - Authenticated (Contributor+) Stored Cross-Site ScriptingFlexmls® IDX Plugin
- CVE-2024-12809Wishlist <= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scriptingpickplugins Wishlist
- CVE-2025-2067projectworlds Life Insurance Management System search.php sql injectionprojectworlds Life Insurance Management System
- CVE-2025-2066projectworlds Life Insurance Management System updateAgent.php sql injectionprojectworlds Life Insurance Management System
- CVE-2025-2065projectworlds Life Insurance Management System editAgent.php sql injectionprojectworlds Life Insurance Management System
- CVE-2025-2064projectworlds Life Insurance Management System deletePayment.php sql injectionprojectworlds Life Insurance Management System
- CVE-2025-2063projectworlds Life Insurance Management System deleteNominee.php sql injectionprojectworlds Life Insurance Management System
- CVE-2025-2062projectworlds Life Insurance Management System clientStatus.php sql injectionprojectworlds Life Insurance Management System
- CVE-2025-2061code-projects Online Ticket Reservation System passenger.php cross site scriptingcode-projects Online Ticket Reservation System
- CVE-2025-26708ZTELink has a configuration defect vulnerabilityZTE Link
- CVE-2025-2060PHPGurukul Emergency Ambulance Hiring Portal admin-profile.php sql injectionPHPGurukul Emergency Ambulance Hiring Portal
- CVE-2025-2059PHPGurukul Emergency Ambulance Hiring Portal booking-details.php sql injectionPHPGurukul Emergency Ambulance Hiring Portal
- CVE-2025-0748Homey <= 2.4.3 - Cross-Site Request Forgery to User VerificationFave Themes Homey
- CVE-2024-13526EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Exportmetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2025-2058PHPGurukul Emergency Ambulance Hiring Portal search.php sql injectionPHPGurukul Emergency Ambulance Hiring Portal
- CVE-2025-2057PHPGurukul Emergency Ambulance Hiring Portal about-us.php sql injectionPHPGurukul Emergency Ambulance Hiring Portal
- CVE-2025-2054code-projects Blood Bank Management System edit_state.php sql injectioncode-projects Blood Bank Management System
- CVE-2025-2053PHPGurukul Apartment Visitors Management System visitor-detail.php sql injectionPHPGurukul Apartment Visitors Management System
- CVE-2025-2052PHPGurukul Apartment Visitors Management System forgot-password.php sql injectionPHPGurukul Apartment Visitors Management System
- CVE-2025-2051PHPGurukul Apartment Visitors Management System search-visitor.php sql injectionPHPGurukul Apartment Visitors Management System
- CVE-2025-25617Incorrect Access Control in Unifiedtransform 2.X leads to Privilege Escalation allowing teachers to create syllabus.
- CVE-2025-27795ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.GraphicsMagick
- CVE-2025-27796ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory iGraphicsMagick
- CVE-2025-27823An issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS.backdropcms Mail Disguise
- CVE-2025-27824An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS.backdropcms Link iframe formatter
- CVE-2025-27825An XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS.backdropcms Bootstrap 5 Lite theme
- CVE-2025-27826An XSS issue was discovered in the Bootstrap Lite theme before 1.x-1.4.5 for Backdrop CMS.backdropcms Bootstrap Lite theme
- CVE-2025-27839operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuinTangem SDK