CVEs published March 14, 2025
86 CVEs were published on March 14, 2025: 19 critical, 28 high.
- Published
- 86
- Critical
- 19
- High
- 28
- Medium
- 37
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- LogicalDOC Community · LogicalDOC Enterprise
- 7
- WP JobHunt
- 4
- HDF5
- 3
- SICK AG SICK DL100-2xxxxxxx
- 3
- uxper Civi - Job Board & Freelance Marketplace WordPress Th…
- 3
- DavidOsipov PostQuantum-Feldman-VSS · postquantum-feldman-v…
- 2
- Fortinet FortiWeb
- 2
- IBM QRadar EDR
- 2
- node-saml xml-crypto · xml-crypto
- 2
- xmlsoft libxslt
- 2
Critical 19
- CVE-2025-29775xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Commentnode-saml xml-crypto · xml-crypto
- CVE-2025-29774xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo Referencesnode-saml xml-crypto · xml-crypto
- CVE-2025-2000Qiskit SDK code executionIBM Qiskit SDK · qiskit-terra +1
- CVE-2025-27595Weak hashing alghrythmSICK AG SICK DL100-2xxxxxxx
- CVE-2025-27593RCE due to Device DriverSICK AG SICK DL100-2xxxxxxx
- CVE-2025-2304Camaleon CMS Privilege Escalationowen2345 camaleon-cms · camaleon_cms
- CVE-2025-2232Realteo - Real Estate Plugin by Purethemes <= 1.2.8 - Authentication Bypass via 'do_register_user'PureThemes Realteo
- CVE-2024-13771Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Authentication Bypass via Password Updateuxper Civi - Job Board & Freelance Marketplace WordPress Th…
- CVE-2024-13824CiyaShop - Multipurpose WooCommerce Theme <= 4.19.0 - Unauthenticated PHP Object InjectionPotenzaglobalsolutions CiyaShop - Multipurpose WooCommerce…
- CVE-2024-11286WP JobHunt <= 7.1 - Authentication BypassWP JobHunt
- CVE-2024-11284WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account TakeoverWP JobHunt
- CVE-2024-11285WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account TakeoverWP JobHunt
- CVE-2025-26163CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the CPF parameter.
- CVE-2025-29029Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formSetSpeedWan function.
- CVE-2025-29030Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formWifiWpsOOB function.
- CVE-2025-29031Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the fromAddressNat function.
- CVE-2025-29384In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to
- CVE-2025-29385In Tenda AC9 v1.0 V15.03.05.14_multi, the cloneType parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead
- CVE-2025-29386In Tenda AC9 v1.0 V15.03.05.14_multi, the mac parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to rem
High 28
- CVE-2024-12245Blind SQL Injection in LogoutLogicalDOC Community · LogicalDOC Enterprise
- CVE-2024-12019Arbitrary File Read via Document APILogicalDOC Community · LogicalDOC Enterprise
- CVE-2024-54449Remote Code Execution (RCE) via Arbitrary File Write In Document APILogicalDOC Community · LogicalDOC Enterprise
- CVE-2024-54448Remote Code Execution (RCE) via Automation ScriptingLogicalDOC Community · LogicalDOC Enterprise
- CVE-2024-54447Blind SQLi in Saved SearchLogicalDOC Community · LogicalDOC Enterprise
- CVE-2024-54446Blind SQLi in Document HistoryLogicalDOC Community · LogicalDOC Enterprise
- CVE-2024-54445Blind SQLi in LoginLogicalDOC Community · LogicalDOC Enterprise
- CVE-2023-45588An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installFortinet FortiClientMac
- CVE-2024-46662A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiManager versions 7.4.1 through 7.4.3,Fortinet FortiManager
- CVE-2023-52927netfilter: allow exp not to be removed in nf_ct_find_expectationLinux
- CVE-2025-29776Azle calling `setTimer` causes infinite loop of timersdemergent-labs azle · azle
- CVE-2025-27594Unencrypted transmission of password hashSICK AG SICK DL100-2xxxxxxx
- CVE-2024-13773Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information Exposureuxper Civi - Job Board & Freelance Marketplace WordPress Th…
- CVE-2024-12810JobCareer | Job Board Responsive WordPress Theme <= 7.1 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrative ActionsJobCareer | Job Board Responsive WordPress Theme
- CVE-2024-8176Libexpat: expat: improper restriction of xml entity expansion depth in libexpatlibexpat · Red Hat Enterprise Linux +4
- CVE-2024-13321AnalyticsWP <= 2.0.0 - Unauthenticated SQL InjectionSolid Plugins AnalyticsWP
- CVE-2025-2221WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injectionwhyun WPCOM Member
- CVE-2024-13913InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File InclusionInstaWP Connect – 1-click WP Staging & Migration
- CVE-2025-2103SoundRise Music <= 1.7 - Authenticated (Subscriber+) Arbitrary Options UpdateIronTemplates SoundRise Music
- CVE-2024-13376Industrial <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateAnps Industrial
- CVE-2025-0952Eco Nature - Environment & Ecology WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Updatecmsmasters Eco Nature - Environment & Ecology WordPress The…
- CVE-2025-1764LoginPress <= 3.3.1 - Cross-Site Request Forgery to Arbitrary Options Updatehiddenpearls LoginPress | wp-login Custom Login Page Custom…
- CVE-2025-2056WP Ghost <= 5.4.01 - Unauthenticated Limited File Readjohndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall
- CVE-2024-11283WP JobHunt <= 7.1 - Authentication Bypass to CandidateWP JobHunt
- CVE-2024-55549xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.xmlsoft libxslt
- CVE-2025-24855numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but nevexmlsoft libxslt
- CVE-2025-25871An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function
- CVE-2025-29387In Tenda AC9 v1.0 V15.03.05.14_multi, the wanSpeed parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead t
Medium, low and unrated 39
- CVE-2025-2320274056675 springboot-openai-chatgpt User submit improper authorization274056675 springboot-openai-chatgpt
- CVE-2025-2295Potential iSCSI R2T PDU VulnerabilityTianoCore EDK2
- CVE-2025-2310HDF5 Metadata Attribute Decoder H5MM_strndup heap-based overflowHDF5
- CVE-2025-2309HDF5 Type Conversion Logic H5T__bit_copy heap-based overflowHDF5
- CVE-2025-2308HDF5 Scale-Offset Filter H5Z__scaleoffset_decompress_one_byte heap-based overflowHDF5
- CVE-2025-29782WeGIA Cross-Site Scripting (XSS) Stored in endpoint `adicionar_tipo_docs_atendido.php` parameter `tipo`LabRedesCefetRJ WeGIA
- CVE-2025-29771HtmlSanitizer vulnerable to XSS when used with contentEditablejitbit HtmlSanitizer · @jitbit/htmlsanitizer
- CVE-2024-12020Reflected Cross-Site Scripting (XSS)LogicalDOC Enterprise
- CVE-2025-29780Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix OperationsDavidOsipov PostQuantum-Feldman-VSS · postquantum-feldman-v…
- CVE-2025-29779Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`DavidOsipov PostQuantum-Feldman-VSS · postquantum-feldman-v…
- CVE-2025-27606Element Android PIN autologout bypasselement-hq element-android
- CVE-2024-55594An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 Fortinet FortiWeb
- CVE-2025-1888Reflected Cross Site Scripting in Aperio Eslide ManagerLeica BioSystems Aperio Eslide Manager
- CVE-2023-48785An improper certificate validation vulnerability [CWE-295] in FortiNAC-F version 7.2.4 and below may allow a remote and unauthenticated attaFortinet FortiNAC-F
- CVE-2023-33300A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlFortinet FortiNAC
- CVE-2024-40585An insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiManager version 7.4.0, version 7.2.3 and below, versioFortinet FortiAnalyzer · Fortinet FortiManager
- CVE-2022-29059An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb version 7.0.1 andFortinet FortiWeb
- CVE-2024-47573An improper validation of integrity check value vulnerability [CWE-354] in FortiNDR version 7.4.2 and below, version 7.2.1 and below, versioFortinet FortiNDR
- CVE-2024-40590An improper certificate validation vulnerability [CWE-295] in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, vFortinet FortiPortal
- CVE-2024-45638IBM QRadar EDR information disclosureIBM QRadar EDR
- CVE-2024-45643IBM QRadar EDR information disclosureIBM QRadar EDR
- CVE-2025-2268HP LaserJet MFP M232-M237 Printer Series - Potential Denial of ServiceHP LaserJet MFP M232-M237 Printer Series
- CVE-2025-26626GLPI Inventory Plugin vulnerable to reflective Cross-site Scriptingglpi-project glpi-inventory-plugin
- CVE-2024-13772Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.6.1 - Authentication Bypassuxper Civi - Job Board & Freelance Marketplace WordPress Th…
- CVE-2024-26006An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and Fortinet FortiProxy · Fortinet FortiOS
- CVE-2025-1507ShareThis Dashboard for Google Analytics <= 3.2.1 - Missing Authorization to Unauthenticated Feature DeactivationShareThis Dashboard for Google Analytics
- CVE-2024-13407Omnipress <= 1.5.4 - Authenticated (Contributor+) Post Disclosureomnipressteam Omnipress
- CVE-2025-1526DethemeKit for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingDethemeKit for Elementor
- CVE-2025-2289Zegen - Church WordPress Theme <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Theme Options Updateszozothemes Zegen - Church WordPress Theme
- CVE-2025-0955VidoRev Extensions <= 2.9.9.9.9.9.5 - Missing Authorization to Unauthenticated Youtube Video Importbeeteam368 VidoRev Extensions
- CVE-2025-2166CM FAQ – Simplify support with an intuitive FAQ management tool <= 1.2.5 - Reflected Cross-Site Scriptingcreativemindssolutions CM FAQ – Simplify support with an i…
- CVE-2025-1528Search and filter pro <= 2.5.19 - Missing Authorization to Authenticated (Subscriber+) Post Meta ExposureSearch & Filter Pro
- CVE-2025-1285Resido - Real Estate WordPress Theme <= 3.6 - Missing Authorization to Unauthenticated Server-Side Request Forgery and API Key Settings UpdateSmartDataSoft Resido - Real Estate WordPress Theme
- CVE-2024-29409File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.@nestjs/common
- CVE-2025-25872An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function
- CVE-2025-25873Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges via the Change Root
- CVE-2025-26312SendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the Captcha parameter.SendQuick Entera
- CVE-2025-29032Tenda AC9 v15.03.05.19(6318) was discovered to contain a buffer overflow via the formWifiWpsOOB function.
- CVE-2025-30022CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter.