CVEs published March 13, 2025
90 CVEs were published on March 13, 2025: 2 critical, 53 high.
- Published
- 90
- Critical
- 2
- High
- 53
- Medium
- 32
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- Autodesk AutoCAD · Autodesk Civil +1
- 11
- GitLab
- 6
- Rising Technosoft CAP back office application
- 5
- Santesoft Sante PACS Server
- 4
- dataease
- 3
- Devolutions Server
- 3
- Optigo Networks Visual BACnet Capture Tool · Optigo Network…
- 3
- ArielBrailovsky-ViralAd
- 2
- Devolutions Remote Desktop Manager
- 2
- Kubernetes Kubelet · k8s.io/kubernetes
- 2
Critical 2
- CVE-2025-2080Authentication Bypass Using an Alternate Path or Channel in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture ToolOptigo Networks Visual BACnet Capture Tool · Optigo Network…
- CVE-2025-2263Santesoft Sante PACS Server Stack-based Buffer OverflowSantesoft Sante PACS Server
High 53
- CVE-2025-2229Philips Intellispace Cardiovascular (ISCV) Use of Weak CredentialsPhilips Intellispace Cardiovascular
- CVE-2025-2230Philips Intellispace Cardiovascular (ISCV) Improper AuthenticationPhilips Intellispace Cardiovascular
- CVE-2025-24053Microsoft Dataverse Elevation of Privilege VulnerabilityMicrosoft Dataverse
- CVE-2025-2081Use of Hard-Coded, Security-Relevant ConstantsOptigo Networks Visual BACnet Capture Tool · Optigo Network…
- CVE-2025-2079Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture ToolOptigo Networks Visual BACnet Capture Tool · Optigo Network…
- CVE-2025-27107Integrated Scripting vulnerable to arbitrary code execution via Java reflectionCyclopsMC IntegratedScripting
- CVE-2025-1652MODEL File Parsing Out-of-Bounds Read VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-1651MODEL File Parsing Heap-Based Buffer Overflow VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-1650CATPRODUCT File Parsing Uninitialized Variable VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-1649CATPRODUCT File Parsing Uninitialized Variable VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-1433MODEL File Parsing Out-of-Bounds Read VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-27138DataEase has an improper authentication vulnerabilitydataease
- CVE-2025-14323DM File Parsing Use-After-Free VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-1431SLDPRT File Parsing Out-of-Bounds Read VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-1430SLDPRT File Parsing Memory Corruption VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-1429MODEL File Parsing Heap-Based Buffer Overflow VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-1428CATPRODUCT File Parsing Out-of-Bounds Read VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-1427CATPRODUCT File Parsing Uninitialized Variable VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-27103Dataease Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerabilitydataease
- CVE-2025-24974DataEase Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerabilitydataease
- CVE-2025-2284Santesoft Sante PACS Server Access of Uninitialized Pointer DoSSantesoft Sante PACS Server
- CVE-2025-2265Santesoft Sante PACS Server HTTP.db SHA1 Hash TruncationSantesoft Sante PACS Server
- CVE-2025-2264Santesoft Sante PACS Server Path Traversal Information DisclosureSantesoft Sante PACS Server
- CVE-2025-2280Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to Devolutions Server
- CVE-2025-2277Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leDevolutions Server
- CVE-2024-10942All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injectionservmask All-in-One WP Migration and Backup
- CVE-2025-29998No Rate Limiting Vulnerability in CAP back office applicationRising Technosoft CAP back office application
- CVE-2025-29997Improper Access Control Vulnerability in CAP back office applicationRising Technosoft CAP back office application
- CVE-2025-29996Authentication Bypass Vulnerability in CAP back office applicationRising Technosoft CAP back office application
- CVE-2025-29995Account Takeover Vulnerability in CAP back office applicationRising Technosoft CAP back office application
- CVE-2025-29994Improper Authentication Vulnerability in CAP back office applicationRising Technosoft CAP back office application
- CVE-2025-25175A vulnerability has been identified in Simcenter Femap V2401 (All versions < V2401.0003), Simcenter Femap V2406 (All versions < V2406.0002).Siemens Simcenter Femap
- CVE-2025-1119Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Executioncroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2025-2271IDOR in Issuetrak NewAuditID parameter via Inv_PopTrakXShow.aspissuetrak audit
- CVE-2025-1487WoWPth <= 2.0 - Reflected XSSWoWPth
- CVE-2025-1486WoWPth <= 2.0 - Reflected XSSWoWPth
- CVE-2025-1436Limit Bio <= 1.0 - Stored XSS via CSRFLimit Bio
- CVE-2025-1401WP Click Info <= 2.7.4 - Reflected XSSWP Click Info
- CVE-2024-13891Schedule <= 1.0.0 - Reflected XSSSchedule
- CVE-2024-13885WP E Customers <= 0.0.1 - Reflected XSSWP e-Customers Beta
- CVE-2024-13884Limit Bio <= 1.0 - Reflected XSSLimit Bio
- CVE-2025-1561AppPresser – Mobile App Framework <= 4.4.10 - Unauthenticated Stored Cross-Site Scriptingscottopolis AppPresser – Mobile App Framework
- CVE-2025-2107Arielbrailovsky-Viralad <= 1.0.8 - Unauthenticated SQL InjectionArielBrailovsky-ViralAd
- CVE-2025-2106Arielbrailovsky-Viralad <= 1.0.8 - Unauthenticated SQL InjectionArielBrailovsky-ViralAd
- CVE-2024-53406Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass.
- CVE-2025-25598Incorrect access control in the scheduled tasks console of Inova Logic CUSTOMER MONITOR (CM) v3.1.757.1 allows attackers to escalate privile
- CVE-2025-29357Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the startIp and endIp parameters at /goform/SetPptpServ
- CVE-2025-29358Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the firewallEn parameter at /goform/SetFirewallCfg.
- CVE-2025-29359Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the deviceId parameter at /goform/saveParentControlInfo
- CVE-2025-29360Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the time and timeZone parameters at /goform/SetSysTimeC
- CVE-2025-29361Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the list parameter at /goform/SetVirtualServerCfg.
- CVE-2025-29362Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the list parameter at /goform/setPptpUserList.
- CVE-2025-29363Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to buffer overflow via the schedStartTime and schedEndTime parameters at /gofo
Medium, low and unrated 35
- CVE-2025-27496Snowflake JDBC Driver client-side encryption key in DEBUG logssnowflakedb snowflake-jdbc · net.snowflake:snowflake-jdbc
- CVE-2024-30143A path traversal vulnerability in HCL AppScan Traffic RecorderHCL Software HCL AppScan Traffic Recorder
- CVE-2025-29773Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account TakeoverFroxlor · froxlor/froxlor
- CVE-2025-29768Vim vulnerable to potential data loss with zip.vim and special crafted zip filesvim
- CVE-2025-1767This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same Kubernetes Kubelet · k8s.io/kubernetes
- CVE-2024-9042This CVE affects only Windows worker nodes.Kubernetes Kubelet · k8s.io/kubernetes
- CVE-2025-2278Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an aDevolutions Server
- CVE-2025-1636Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and Devolutions Remote Desktop Manager
- CVE-2025-1635Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows aDevolutions Remote Desktop Manager
- CVE-2025-21104Dell NetWorker, versions prior to 19.11.0.4 and version 19.12, contains an URL Redirection to Untrusted Site ('Open Redirect') VulnerabilityDell NetWorker
- CVE-2025-1785Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwritecodename065 Download Manager
- CVE-2024-7296Incorrect Authorization in GitLabGitLab
- CVE-2025-1257Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2024-8402Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLabGitLab
- CVE-2024-12380Generation of Error Message Containing Sensitive Information in GitLabGitLab
- CVE-2024-13054Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-0652Incorrect Authorization in GitLabGitLab
- CVE-2025-1503WP Recipe Maker <= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrechtvds WP Recipe Maker
- CVE-2025-2104Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publicationsoftaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2025-2250WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins <= 2.32 - Authenticated (Admin+) SQL Injectionsminozzi ReportAttacks — Brute Force & Login Protection
- CVE-2024-13887Business Directory Plugin - Easy Listing Directories for WordPress <= 6.4.14 - Insecure Direct Object Reference to Listing Arbitrary Image Additionstrategy11team Business Directory Plugin – Easy Listing Dir…
- CVE-2024-13703CRM and Lead Management by vcita <= 2.7.5 - Missing Authorization to Authenticated (Susbcriber+) Widget ToggleCRM and Lead Management by vcita
- CVE-2025-1559CC-IMG-Shortcode <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingclearcodehq CC-IMG-Shortcode
- CVE-2020-36843The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA str4d ed25519-java · net.i2p.crypto:eddsa +1
- CVE-2024-22880Cross Site Scripting vulnerability in Zadarma Zadarma extension v.1.0.11 allows a remote attacker to execute a arbitrary code via a crafted
- CVE-2024-28803Cross-site scripting (XSS) vulnerability in Italtel S.p.A.
- CVE-2024-55060A cross-site scripting (XSS) vulnerability in the component index.php of Rafed CMS Website v1.44 allows attackers to execute arbitrary web s
- CVE-2024-55198User Enumeration via Discrepancies in Error Messages in the Celk Sistemas Celk Saude v.3.1.252.1 password recovery functionality which allow
- CVE-2024-57062An issue in SoundCloud IOS application v.7.65.2 allows a local attacker to escalate privileges and obtain sensitive information via the sess
- CVE-2024-57348Cross Site Scripting vulnerability in PecanProject pecan through v.1.8.0 allows a remote attacker to execute arbitrary code via the crafted
- CVE-2025-25363An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) be
- CVE-2025-25625A stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d_118101 and w
- CVE-2025-28010A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0.modx/revolution
- CVE-2025-28011A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows
- CVE-2025-28015A HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management Sys