# CVEs published 2025-03-13

90 CVEs were published on March 13, 2025: 2 critical, 53 high. Days are UTC.

- [CVE-2025-27496](https://cve.now/CVE-2025-27496.md): Snowflake JDBC Driver client-side encryption key in DEBUG logs (CVSS 3.3, snowflakedb snowflake-jdbc · net.snowflake:snowflake-jdbc)
- [CVE-2025-2229](https://cve.now/CVE-2025-2229.md): Philips Intellispace Cardiovascular (ISCV) Use of Weak Credentials (CVSS 7.7, Philips Intellispace Cardiovascular)
- [CVE-2025-2230](https://cve.now/CVE-2025-2230.md): Philips Intellispace Cardiovascular (ISCV) Improper Authentication (CVSS 7.7, Philips Intellispace Cardiovascular)
- [CVE-2024-30143](https://cve.now/CVE-2024-30143.md): A path traversal vulnerability in HCL AppScan Traffic Recorder (CVSS 4.3, HCL Software HCL AppScan Traffic Recorder)
- [CVE-2025-24053](https://cve.now/CVE-2025-24053.md): Microsoft Dataverse Elevation of Privilege Vulnerability (CVSS 7.2, Microsoft Dataverse)
- [CVE-2025-29773](https://cve.now/CVE-2025-29773.md): Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover (CVSS 5.8, Froxlor · froxlor/froxlor)
- [CVE-2025-29768](https://cve.now/CVE-2025-29768.md): Vim vulnerable to potential data loss with zip.vim and special crafted zip files (CVSS 4.4, vim)
- [CVE-2025-2081](https://cve.now/CVE-2025-2081.md): Use of Hard-Coded, Security-Relevant Constants (CVSS 8.7, Optigo Networks Visual BACnet Capture Tool · Optigo Network…)
- [CVE-2025-2080](https://cve.now/CVE-2025-2080.md): Authentication Bypass Using an Alternate Path or Channel in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool (CVSS 9.3, Optigo Networks Visual BACnet Capture Tool · Optigo Network…)
- [CVE-2025-2079](https://cve.now/CVE-2025-2079.md): Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool (CVSS 8.7, Optigo Networks Visual BACnet Capture Tool · Optigo Network…)
- [CVE-2025-27107](https://cve.now/CVE-2025-27107.md): Integrated Scripting vulnerable to arbitrary code execution via Java reflection (CVSS 8.6, CyclopsMC IntegratedScripting)
- [CVE-2025-1652](https://cve.now/CVE-2025-1652.md): MODEL File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-1651](https://cve.now/CVE-2025-1651.md): MODEL File Parsing Heap-Based Buffer Overflow Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-1650](https://cve.now/CVE-2025-1650.md): CATPRODUCT File Parsing Uninitialized Variable Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-1649](https://cve.now/CVE-2025-1649.md): CATPRODUCT File Parsing Uninitialized Variable Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-1433](https://cve.now/CVE-2025-1433.md): MODEL File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-27138](https://cve.now/CVE-2025-27138.md): DataEase has an improper authentication vulnerability (CVSS 7.7, dataease)
- [CVE-2025-1432](https://cve.now/CVE-2025-1432.md): 3DM File Parsing Use-After-Free Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-1431](https://cve.now/CVE-2025-1431.md): SLDPRT File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-1430](https://cve.now/CVE-2025-1430.md): SLDPRT File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-1429](https://cve.now/CVE-2025-1429.md): MODEL File Parsing Heap-Based Buffer Overflow Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-1428](https://cve.now/CVE-2025-1428.md): CATPRODUCT File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-1427](https://cve.now/CVE-2025-1427.md): CATPRODUCT File Parsing Uninitialized Variable Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-27103](https://cve.now/CVE-2025-27103.md): Dataease Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability​ (CVSS 7.3, dataease)
- [CVE-2025-1767](https://cve.now/CVE-2025-1767.md): This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same (CVSS 6.5, Kubernetes Kubelet · k8s.io/kubernetes)
- [CVE-2024-9042](https://cve.now/CVE-2024-9042.md): This CVE affects only Windows worker nodes. (CVSS 5.9, Kubernetes Kubelet · k8s.io/kubernetes)
- [CVE-2025-24974](https://cve.now/CVE-2025-24974.md): DataEase Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability (CVSS 7.3, dataease)
- [CVE-2025-2284](https://cve.now/CVE-2025-2284.md): Santesoft Sante PACS Server Access of Uninitialized Pointer DoS (CVSS 7.5, Santesoft Sante PACS Server)
- [CVE-2025-2265](https://cve.now/CVE-2025-2265.md): Santesoft Sante PACS Server HTTP.db SHA1 Hash Truncation (CVSS 7.8, Santesoft Sante PACS Server)
- [CVE-2025-2264](https://cve.now/CVE-2025-2264.md): Santesoft Sante PACS Server Path Traversal Information Disclosure (CVSS 7.5, Santesoft Sante PACS Server)
- [CVE-2025-2263](https://cve.now/CVE-2025-2263.md): Santesoft Sante PACS Server Stack-based Buffer Overflow (CVSS 9.8, Santesoft Sante PACS Server)
- [CVE-2025-2280](https://cve.now/CVE-2025-2280.md): Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to (CVSS 8.1, Devolutions Server)
- [CVE-2025-2278](https://cve.now/CVE-2025-2278.md): Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an a (CVSS 6.5, Devolutions Server)
- [CVE-2025-1636](https://cve.now/CVE-2025-1636.md): Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and (CVSS 6.5, Devolutions Remote Desktop Manager)
- [CVE-2025-1635](https://cve.now/CVE-2025-1635.md): Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows a (CVSS 6.5, Devolutions Remote Desktop Manager)
- [CVE-2025-2277](https://cve.now/CVE-2025-2277.md): Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently le (CVSS 7.5, Devolutions Server)
- [CVE-2024-10942](https://cve.now/CVE-2024-10942.md): All in One WP Migration \<= 7.89 - Unauthenticated PHP Object Injection (CVSS 7.5, servmask All-in-One WP Migration and Backup)
- [CVE-2025-21104](https://cve.now/CVE-2025-21104.md): Dell NetWorker, versions prior to 19.11.0.4 and version 19.12, contains an URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVSS 4.3, Dell NetWorker)
- [CVE-2025-29998](https://cve.now/CVE-2025-29998.md): No Rate Limiting Vulnerability in CAP back office application (CVSS 8.2, Rising Technosoft CAP back office application)
- [CVE-2025-29997](https://cve.now/CVE-2025-29997.md): Improper Access Control Vulnerability in CAP back office application (CVSS 8.2, Rising Technosoft CAP back office application)
- [CVE-2025-29996](https://cve.now/CVE-2025-29996.md): Authentication Bypass Vulnerability in CAP back office application (CVSS 8.2, Rising Technosoft CAP back office application)
- [CVE-2025-29995](https://cve.now/CVE-2025-29995.md): Account Takeover Vulnerability in CAP back office application (CVSS 8.3, Rising Technosoft CAP back office application)
- [CVE-2025-29994](https://cve.now/CVE-2025-29994.md): Improper Authentication Vulnerability in CAP back office application (CVSS 8.2, Rising Technosoft CAP back office application)
- [CVE-2025-25175](https://cve.now/CVE-2025-25175.md): A vulnerability has been identified in Simcenter Femap V2401 (All versions \< V2401.0003), Simcenter Femap V2406 (All versions \< V2406.0002). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2025-1785](https://cve.now/CVE-2025-1785.md): Download Manager \<= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite (CVSS 5.4, codename065 Download Manager)
- [CVE-2025-1119](https://cve.now/CVE-2025-1119.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2025-2271](https://cve.now/CVE-2025-2271.md): IDOR in Issuetrak NewAuditID parameter via Inv\_PopTrakXShow.asp (CVSS 7.7, issuetrak audit)
- [CVE-2024-7296](https://cve.now/CVE-2024-7296.md): Incorrect Authorization in GitLab (CVSS 2.7, GitLab)
- [CVE-2025-1257](https://cve.now/CVE-2025-1257.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-1487](https://cve.now/CVE-2025-1487.md): WoWPth \<= 2.0 - Reflected XSS (CVSS 7.1, WoWPth)
- [CVE-2025-1486](https://cve.now/CVE-2025-1486.md): WoWPth \<= 2.0 - Reflected XSS (CVSS 7.1, WoWPth)
- [CVE-2025-1436](https://cve.now/CVE-2025-1436.md): Limit Bio \<= 1.0 - Stored XSS via CSRF (CVSS 7.1, Limit Bio)
- [CVE-2025-1401](https://cve.now/CVE-2025-1401.md): WP Click Info \<= 2.7.4 - Reflected XSS (CVSS 7.1, WP Click Info)
- [CVE-2024-13891](https://cve.now/CVE-2024-13891.md): Schedule \<= 1.0.0 - Reflected XSS (CVSS 7.1, Schedule)
- [CVE-2024-13885](https://cve.now/CVE-2024-13885.md): WP E Customers \<= 0.0.1 - Reflected XSS (CVSS 7.1, WP e-Customers Beta)
- [CVE-2024-13884](https://cve.now/CVE-2024-13884.md): Limit Bio \<= 1.0 - Reflected XSS (CVSS 7.1, Limit Bio)
- [CVE-2024-8402](https://cve.now/CVE-2024-8402.md): Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab (CVSS 3.7, GitLab)
- [CVE-2024-12380](https://cve.now/CVE-2024-12380.md): Generation of Error Message Containing Sensitive Information in GitLab (CVSS 4.4, GitLab)
- [CVE-2024-13054](https://cve.now/CVE-2024-13054.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-0652](https://cve.now/CVE-2025-0652.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-1503](https://cve.now/CVE-2025-1503.md): WP Recipe Maker \<= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, brechtvds WP Recipe Maker)
- [CVE-2025-1561](https://cve.now/CVE-2025-1561.md): AppPresser – Mobile App Framework \<= 4.4.10 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, scottopolis AppPresser – Mobile App Framework)
- [CVE-2025-2104](https://cve.now/CVE-2025-2104.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication (CVSS 4.3, softaculous Page Builder: Pagelayer – Drag and Drop website…)
- [CVE-2025-2250](https://cve.now/CVE-2025-2250.md): WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins \<= 2.32 - Authenticated (Admin+) SQL Injection (CVSS 4.9, sminozzi ReportAttacks — Brute Force & Login Protection)
- [CVE-2024-13887](https://cve.now/CVE-2024-13887.md): Business Directory Plugin - Easy Listing Directories for WordPress \<= 6.4.14 - Insecure Direct Object Reference to Listing Arbitrary Image Addition (CVSS 5.3, strategy11team Business Directory Plugin – Easy Listing Dir…)
- [CVE-2025-2107](https://cve.now/CVE-2025-2107.md): Arielbrailovsky-Viralad \<= 1.0.8 - Unauthenticated SQL Injection (CVSS 7.5, ArielBrailovsky-ViralAd)
- [CVE-2024-13703](https://cve.now/CVE-2024-13703.md): CRM and Lead Management by vcita \<= 2.7.5 - Missing Authorization to Authenticated (Susbcriber+) Widget Toggle (CVSS 4.3, CRM and Lead Management by vcita)
- [CVE-2025-1559](https://cve.now/CVE-2025-1559.md): CC-IMG-Shortcode \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, clearcodehq CC-IMG-Shortcode)
- [CVE-2025-2106](https://cve.now/CVE-2025-2106.md): Arielbrailovsky-Viralad \<= 1.0.8 - Unauthenticated SQL Injection (CVSS 7.5, ArielBrailovsky-ViralAd)
- [CVE-2020-36843](https://cve.now/CVE-2020-36843.md): The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (CVSS 4.3, str4d ed25519-java · net.i2p.crypto:eddsa +1)
- [CVE-2024-22880](https://cve.now/CVE-2024-22880.md): Cross Site Scripting vulnerability in Zadarma Zadarma extension v.1.0.11 allows a remote attacker to execute a arbitrary code via a crafted (CVSS 4.7)
- [CVE-2024-28803](https://cve.now/CVE-2024-28803.md): Cross-site scripting (XSS) vulnerability in Italtel S.p.A. (CVSS 6.1)
- [CVE-2024-53406](https://cve.now/CVE-2024-53406.md): Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. (CVSS 8.8)
- [CVE-2024-55060](https://cve.now/CVE-2024-55060.md): A cross-site scripting (XSS) vulnerability in the component index.php of Rafed CMS Website v1.44 allows attackers to execute arbitrary web s (CVSS 6.1)
- [CVE-2024-55198](https://cve.now/CVE-2024-55198.md): User Enumeration via Discrepancies in Error Messages in the Celk Sistemas Celk Saude v.3.1.252.1 password recovery functionality which allow (CVSS 5.3)
- [CVE-2024-57062](https://cve.now/CVE-2024-57062.md): An issue in SoundCloud IOS application v.7.65.2 allows a local attacker to escalate privileges and obtain sensitive information via the sess (CVSS 6.7)
- [CVE-2024-57348](https://cve.now/CVE-2024-57348.md): Cross Site Scripting vulnerability in PecanProject pecan through v.1.8.0 allows a remote attacker to execute arbitrary code via the crafted (CVSS 6.1)
- [CVE-2025-25363](https://cve.now/CVE-2025-25363.md): An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) be (CVSS 6.5)
- [CVE-2025-25598](https://cve.now/CVE-2025-25598.md): Incorrect access control in the scheduled tasks console of Inova Logic CUSTOMER MONITOR (CM) v3.1.757.1 allows attackers to escalate privile (CVSS 8.8)
- [CVE-2025-25625](https://cve.now/CVE-2025-25625.md): A stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d\_118101 and w (CVSS 5.4)
- [CVE-2025-28010](https://cve.now/CVE-2025-28010.md): A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. (CVSS 5.4, modx/revolution)
- [CVE-2025-28011](https://cve.now/CVE-2025-28011.md): A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows (CVSS 6.1)
- [CVE-2025-28015](https://cve.now/CVE-2025-28015.md): A HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management Sys (CVSS 5.3)
- [CVE-2025-29357](https://cve.now/CVE-2025-29357.md): Tenda RX3 US\_RX3V1.0br\_V16.03.13.11\_multi\_TDE01 is vulnerable to Buffer Overflow via the startIp and endIp parameters at /goform/SetPptpServ (CVSS 7.5)
- [CVE-2025-29358](https://cve.now/CVE-2025-29358.md): Tenda RX3 US\_RX3V1.0br\_V16.03.13.11\_multi\_TDE01 is vulnerable to Buffer Overflow via the firewallEn parameter at /goform/SetFirewallCfg. (CVSS 7.5)
- [CVE-2025-29359](https://cve.now/CVE-2025-29359.md): Tenda RX3 US\_RX3V1.0br\_V16.03.13.11\_multi\_TDE01 is vulnerable to Buffer Overflow via the deviceId parameter at /goform/saveParentControlInfo (CVSS 7.5)
- [CVE-2025-29360](https://cve.now/CVE-2025-29360.md): Tenda RX3 US\_RX3V1.0br\_V16.03.13.11\_multi\_TDE01 is vulnerable to Buffer Overflow via the time and timeZone parameters at /goform/SetSysTimeC (CVSS 7.5)
- [CVE-2025-29361](https://cve.now/CVE-2025-29361.md): Tenda RX3 US\_RX3V1.0br\_V16.03.13.11\_multi\_TDE01 is vulnerable to Buffer Overflow via the list parameter at /goform/SetVirtualServerCfg. (CVSS 7.5)
- [CVE-2025-29362](https://cve.now/CVE-2025-29362.md): Tenda RX3 US\_RX3V1.0br\_V16.03.13.11\_multi\_TDE01 is vulnerable to Buffer Overflow via the list parameter at /goform/setPptpUserList. (CVSS 7.5)
- [CVE-2025-29363](https://cve.now/CVE-2025-29363.md): Tenda RX3 US\_RX3V1.0br\_V16.03.13.11\_multi\_TDE01 is vulnerable to buffer overflow via the schedStartTime and schedEndTime parameters at /gofo (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.