# CVEs published 2025-03-14

86 CVEs were published on March 14, 2025: 19 critical, 28 high. Days are UTC.

- [CVE-2025-2320](https://cve.now/CVE-2025-2320.md): 274056675 springboot-openai-chatgpt User submit improper authorization (CVSS 6.9, 274056675 springboot-openai-chatgpt)
- [CVE-2025-2295](https://cve.now/CVE-2025-2295.md): Potential iSCSI R2T PDU Vulnerability (CVSS 3.5, TianoCore EDK2)
- [CVE-2025-2310](https://cve.now/CVE-2025-2310.md): HDF5 Metadata Attribute Decoder H5MM\_strndup heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-2309](https://cve.now/CVE-2025-2309.md): HDF5 Type Conversion Logic H5T\_\_bit\_copy heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-2308](https://cve.now/CVE-2025-2308.md): HDF5 Scale-Offset Filter H5Z\_\_scaleoffset\_decompress\_one\_byte heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-29782](https://cve.now/CVE-2025-29782.md): WeGIA Cross-Site Scripting (XSS) Stored in endpoint \`adicionar\_tipo\_docs\_atendido.php\` parameter \`tipo\` (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-29771](https://cve.now/CVE-2025-29771.md): HtmlSanitizer vulnerable to XSS when used with contentEditable (CVSS 5.3, jitbit HtmlSanitizer · @jitbit/htmlsanitizer)
- [CVE-2024-12245](https://cve.now/CVE-2024-12245.md): Blind SQL Injection in Logout (CVSS 8.7, LogicalDOC Community · LogicalDOC Enterprise)
- [CVE-2024-12020](https://cve.now/CVE-2024-12020.md): Reflected Cross-Site Scripting (XSS) (CVSS 6.4, LogicalDOC Enterprise)
- [CVE-2024-12019](https://cve.now/CVE-2024-12019.md): Arbitrary File Read via Document API (CVSS 7.1, LogicalDOC Community · LogicalDOC Enterprise)
- [CVE-2024-54449](https://cve.now/CVE-2024-54449.md): Remote Code Execution (RCE) via Arbitrary File Write In Document API (CVSS 8.7, LogicalDOC Community · LogicalDOC Enterprise)
- [CVE-2024-54448](https://cve.now/CVE-2024-54448.md): Remote Code Execution (RCE) via Automation Scripting (CVSS 8.6, LogicalDOC Community · LogicalDOC Enterprise)
- [CVE-2024-54447](https://cve.now/CVE-2024-54447.md): Blind SQLi in Saved Search (CVSS 7.1, LogicalDOC Community · LogicalDOC Enterprise)
- [CVE-2024-54446](https://cve.now/CVE-2024-54446.md): Blind SQLi in Document History (CVSS 7.1, LogicalDOC Community · LogicalDOC Enterprise)
- [CVE-2024-54445](https://cve.now/CVE-2024-54445.md): Blind SQLi in Login (CVSS 8.7, LogicalDOC Community · LogicalDOC Enterprise)
- [CVE-2025-29780](https://cve.now/CVE-2025-29780.md): Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations (CVSS 5.8, DavidOsipov PostQuantum-Feldman-VSS · postquantum-feldman-v…)
- [CVE-2025-29779](https://cve.now/CVE-2025-29779.md): Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in \`secure\_redundant\_execution\` (CVSS 5.4, DavidOsipov PostQuantum-Feldman-VSS · postquantum-feldman-v…)
- [CVE-2025-29775](https://cve.now/CVE-2025-29775.md): xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment (CVSS 9.3, node-saml xml-crypto · xml-crypto)
- [CVE-2025-29774](https://cve.now/CVE-2025-29774.md): xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References (CVSS 9.3, node-saml xml-crypto · xml-crypto)
- [CVE-2025-27606](https://cve.now/CVE-2025-27606.md): Element Android PIN autologout bypass (CVSS 5.1, element-hq element-android)
- [CVE-2024-55594](https://cve.now/CVE-2024-55594.md): An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 (CVSS 5.5, Fortinet FortiWeb)
- [CVE-2025-1888](https://cve.now/CVE-2025-1888.md): Reflected Cross Site Scripting in Aperio Eslide Manager (CVSS 4.6, Leica BioSystems Aperio Eslide Manager)
- [CVE-2023-48785](https://cve.now/CVE-2023-48785.md): An improper certificate validation vulnerability \[CWE-295\] in FortiNAC-F version 7.2.4 and below may allow a remote and unauthenticated atta (CVSS 4.4, Fortinet FortiNAC-F)
- [CVE-2023-33300](https://cve.now/CVE-2023-33300.md): A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earl (CVSS 4.8, Fortinet FortiNAC)
- [CVE-2023-45588](https://cve.now/CVE-2023-45588.md): An external control of file name or path vulnerability \[CWE-73\] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below install (CVSS 7.8, Fortinet FortiClientMac)
- [CVE-2024-40585](https://cve.now/CVE-2024-40585.md): An insertion of sensitive information into log file vulnerabilities \[CWE-532\] in FortiManager version 7.4.0, version 7.2.3 and below, versio (CVSS 5.9, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2022-29059](https://cve.now/CVE-2022-29059.md): An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability \[CWE-89\] in FortiWeb version 7.0.1 and (CVSS 2.6, Fortinet FortiWeb)
- [CVE-2024-47573](https://cve.now/CVE-2024-47573.md): An improper validation of integrity check value vulnerability \[CWE-354\] in FortiNDR version 7.4.2 and below, version 7.2.1 and below, versio (CVSS 6.0, Fortinet FortiNDR)
- [CVE-2024-46662](https://cve.now/CVE-2024-46662.md): A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiManager versions 7.4.1 through 7.4.3, (CVSS 8.3, Fortinet FortiManager)
- [CVE-2024-40590](https://cve.now/CVE-2024-40590.md): An improper certificate validation vulnerability \[CWE-295\] in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, v (CVSS 4.4, Fortinet FortiPortal)
- [CVE-2024-45638](https://cve.now/CVE-2024-45638.md): IBM QRadar EDR information disclosure (CVSS 4.1, IBM QRadar EDR)
- [CVE-2024-45643](https://cve.now/CVE-2024-45643.md): IBM QRadar EDR information disclosure (CVSS 5.9, IBM QRadar EDR)
- [CVE-2023-52927](https://cve.now/CVE-2023-52927.md): netfilter: allow exp not to be removed in nf\_ct\_find\_expectation (CVSS 7.8, Linux)
- [CVE-2025-2268](https://cve.now/CVE-2025-2268.md): HP LaserJet MFP M232-M237 Printer Series - Potential Denial of Service (CVSS 6.9, HP LaserJet MFP M232-M237 Printer Series)
- [CVE-2025-29776](https://cve.now/CVE-2025-29776.md): Azle calling \`setTimer\` causes infinite loop of timers (CVSS 8.7, demergent-labs azle · azle)
- [CVE-2025-2000](https://cve.now/CVE-2025-2000.md): Qiskit SDK code execution (CVSS 9.8, IBM Qiskit SDK · qiskit-terra +1)
- [CVE-2025-27595](https://cve.now/CVE-2025-27595.md): Weak hashing alghrythm (CVSS 9.8, SICK AG SICK DL100-2xxxxxxx)
- [CVE-2025-27594](https://cve.now/CVE-2025-27594.md): Unencrypted transmission of password hash (CVSS 7.5, SICK AG SICK DL100-2xxxxxxx)
- [CVE-2025-26626](https://cve.now/CVE-2025-26626.md): GLPI Inventory Plugin vulnerable to reflective Cross-site Scripting (CVSS 6.5, glpi-project glpi-inventory-plugin)
- [CVE-2025-27593](https://cve.now/CVE-2025-27593.md): RCE due to Device Driver (CVSS 9.3, SICK AG SICK DL100-2xxxxxxx)
- [CVE-2025-2304](https://cve.now/CVE-2025-2304.md): Camaleon CMS Privilege Escalation (CVSS 9.4, owen2345 camaleon-cms · camaleon\_cms)
- [CVE-2024-13773](https://cve.now/CVE-2024-13773.md): Civi - Job Board & Freelance Marketplace WordPress Theme \<= 2.1.4 - Sensitive Information Exposure (CVSS 7.3, uxper Civi - Job Board & Freelance Marketplace WordPress Th…)
- [CVE-2024-13772](https://cve.now/CVE-2024-13772.md): Civi - Job Board & Freelance Marketplace WordPress Theme \<= 2.1.6.1 - Authentication Bypass (CVSS 5.6, uxper Civi - Job Board & Freelance Marketplace WordPress Th…)
- [CVE-2025-2232](https://cve.now/CVE-2025-2232.md): Realteo - Real Estate Plugin by Purethemes \<= 1.2.8 - Authentication Bypass via 'do\_register\_user' (CVSS 9.8, PureThemes Realteo)
- [CVE-2024-13771](https://cve.now/CVE-2024-13771.md): Civi - Job Board & Freelance Marketplace WordPress Theme \<= 2.1.4 - Authentication Bypass via Password Update (CVSS 9.8, uxper Civi - Job Board & Freelance Marketplace WordPress Th…)
- [CVE-2024-12810](https://cve.now/CVE-2024-12810.md): JobCareer | Job Board Responsive WordPress Theme \<= 7.1 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrative Actions (CVSS 8.8, JobCareer | Job Board Responsive WordPress Theme)
- [CVE-2024-26006](https://cve.now/CVE-2024-26006.md): An improper neutralization of input during web page Generation vulnerability \[CWE-79\] in FortiOS version 7.4.3 and below, version 7.2.7 and (CVSS 6.9, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2025-1507](https://cve.now/CVE-2025-1507.md): ShareThis Dashboard for Google Analytics \<= 3.2.1 - Missing Authorization to Unauthenticated Feature Deactivation (CVSS 5.3, ShareThis Dashboard for Google Analytics)
- [CVE-2024-8176](https://cve.now/CVE-2024-8176.md): Libexpat: expat: improper restriction of xml entity expansion depth in libexpat (CVSS 7.5, libexpat · Red Hat Enterprise Linux +4)
- [CVE-2024-13407](https://cve.now/CVE-2024-13407.md): Omnipress \<= 1.5.4 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, omnipressteam Omnipress)
- [CVE-2024-13321](https://cve.now/CVE-2024-13321.md): AnalyticsWP \<= 2.0.0 - Unauthenticated SQL Injection (CVSS 7.5, Solid Plugins AnalyticsWP)
- [CVE-2025-1526](https://cve.now/CVE-2025-1526.md): DethemeKit for Elementor \<= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, DethemeKit for Elementor)
- [CVE-2024-13824](https://cve.now/CVE-2024-13824.md): CiyaShop - Multipurpose WooCommerce Theme \<= 4.19.0 - Unauthenticated PHP Object Injection (CVSS 9.8, Potenzaglobalsolutions CiyaShop - Multipurpose WooCommerce…)
- [CVE-2025-2221](https://cve.now/CVE-2025-2221.md): WPCOM Member \<= 1.7.6 - Unauthenticated Time-Based SQL Injection (CVSS 7.5, whyun WPCOM Member)
- [CVE-2024-13913](https://cve.now/CVE-2024-13913.md): InstaWP Connect – 1-click WP Staging & Migration \<= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion (CVSS 8.8, InstaWP Connect – 1-click WP Staging & Migration)
- [CVE-2025-2103](https://cve.now/CVE-2025-2103.md): SoundRise Music \<= 1.7 - Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, IronTemplates SoundRise Music)
- [CVE-2024-13376](https://cve.now/CVE-2024-13376.md): Industrial \<= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, Anps Industrial)
- [CVE-2025-0952](https://cve.now/CVE-2025-0952.md): Eco Nature - Environment & Ecology WordPress Theme \<= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (CVSS 8.1, cmsmasters Eco Nature - Environment & Ecology WordPress The…)
- [CVE-2025-2289](https://cve.now/CVE-2025-2289.md): Zegen - Church WordPress Theme \<= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Theme Options Updates (CVSS 4.3, zozothemes Zegen - Church WordPress Theme)
- [CVE-2025-1764](https://cve.now/CVE-2025-1764.md): LoginPress \<= 3.3.1 - Cross-Site Request Forgery to Arbitrary Options Update (CVSS 7.5, hiddenpearls LoginPress | wp-login Custom Login Page Custom…)
- [CVE-2025-2056](https://cve.now/CVE-2025-2056.md): WP Ghost \<= 5.4.01 - Unauthenticated Limited File Read (CVSS 7.5, johndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall)
- [CVE-2025-0955](https://cve.now/CVE-2025-0955.md): VidoRev Extensions \<= 2.9.9.9.9.9.5 - Missing Authorization to Unauthenticated Youtube Video Import (CVSS 5.3, beeteam368 VidoRev Extensions)
- [CVE-2024-11283](https://cve.now/CVE-2024-11283.md): WP JobHunt \<= 7.1 - Authentication Bypass to Candidate (CVSS 7.5, WP JobHunt)
- [CVE-2024-11286](https://cve.now/CVE-2024-11286.md): WP JobHunt \<= 7.1 - Authentication Bypass (CVSS 9.8, WP JobHunt)
- [CVE-2025-2166](https://cve.now/CVE-2025-2166.md): CM FAQ – Simplify support with an intuitive FAQ management tool \<= 1.2.5 - Reflected Cross-Site Scripting (CVSS 6.1, creativemindssolutions CM FAQ – Simplify support with an i…)
- [CVE-2024-11284](https://cve.now/CVE-2024-11284.md): WP JobHunt \<= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover (CVSS 9.8, WP JobHunt)
- [CVE-2025-1528](https://cve.now/CVE-2025-1528.md): Search and filter pro \<= 2.5.19 - Missing Authorization to Authenticated (Subscriber+) Post Meta Exposure (CVSS 4.3, Search & Filter Pro)
- [CVE-2025-1285](https://cve.now/CVE-2025-1285.md): Resido - Real Estate WordPress Theme \<= 3.6 - Missing Authorization to Unauthenticated Server-Side Request Forgery and API Key Settings Update (CVSS 5.3, SmartDataSoft Resido - Real Estate WordPress Theme)
- [CVE-2024-11285](https://cve.now/CVE-2024-11285.md): WP JobHunt \<= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover (CVSS 9.8, WP JobHunt)
- [CVE-2024-29409](https://cve.now/CVE-2024-29409.md): File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header. (CVSS 5.5, @nestjs/common)
- [CVE-2024-55549](https://cve.now/CVE-2024-55549.md): xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. (CVSS 7.8, xmlsoft libxslt)
- [CVE-2025-24855](https://cve.now/CVE-2025-24855.md): numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but neve (CVSS 7.8, xmlsoft libxslt)
- [CVE-2025-25871](https://cve.now/CVE-2025-25871.md): An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function (CVSS 8.0)
- [CVE-2025-25872](https://cve.now/CVE-2025-25872.md): An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function (CVSS 5.5)
- [CVE-2025-25873](https://cve.now/CVE-2025-25873.md): Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges via the Change Root (CVSS 5.5)
- [CVE-2025-26163](https://cve.now/CVE-2025-26163.md): CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the CPF parameter. (CVSS 9.8)
- [CVE-2025-26312](https://cve.now/CVE-2025-26312.md): SendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the Captcha parameter. (CVSS 5.3, SendQuick Entera)
- [CVE-2025-29029](https://cve.now/CVE-2025-29029.md): Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formSetSpeedWan function. (CVSS 9.8)
- [CVE-2025-29030](https://cve.now/CVE-2025-29030.md): Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formWifiWpsOOB function. (CVSS 9.8)
- [CVE-2025-29031](https://cve.now/CVE-2025-29031.md): Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the fromAddressNat function. (CVSS 9.8)
- [CVE-2025-29032](https://cve.now/CVE-2025-29032.md): Tenda AC9 v15.03.05.19(6318) was discovered to contain a buffer overflow via the formWifiWpsOOB function. (CVSS 5.9)
- [CVE-2025-29384](https://cve.now/CVE-2025-29384.md): In Tenda AC9 v1.0 V15.03.05.14\_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to (CVSS 9.8)
- [CVE-2025-29385](https://cve.now/CVE-2025-29385.md): In Tenda AC9 v1.0 V15.03.05.14\_multi, the cloneType parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead (CVSS 9.8)
- [CVE-2025-29386](https://cve.now/CVE-2025-29386.md): In Tenda AC9 v1.0 V15.03.05.14\_multi, the mac parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to rem (CVSS 9.8)
- [CVE-2025-29387](https://cve.now/CVE-2025-29387.md): In Tenda AC9 v1.0 V15.03.05.14\_multi, the wanSpeed parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead t (CVSS 7.1)
- [CVE-2025-30022](https://cve.now/CVE-2025-30022.md): CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter. (CVSS 6.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.