# CVEs published 2025-03-16 33 CVEs were published on March 16, 2025: 1 critical, 4 high. Days are UTC. - [CVE-2025-2353](https://cve.now/CVE-2025-2353.md): VAM Virtual Airlines Manager HTTP GET Parameter index.php sql injection (CVSS 6.9, VAM Virtual Airlines Manager) - [CVE-2025-2352](https://cve.now/CVE-2025-2352.md): StarSea99 starsea-mall Backend save cross site scripting (CVSS 4.8, StarSea99 starsea-mall) - [CVE-2025-2351](https://cve.now/CVE-2025-2351.md): DayCloud StudentManage Login Endpoint adminScoreUrl sql injection (CVSS 6.9, DayCloud StudentManage) - [CVE-2025-2350](https://cve.now/CVE-2025-2350.md): IROAD Dash Cam FX2 upload\_file unrestricted upload (CVSS 5.3, IROAD Dash Cam FX2) - [CVE-2025-2349](https://cve.now/CVE-2025-2349.md): IROAD Dash Cam FX2 Password Hash passwd weak password hash (CVSS 2.3, IROAD Dash Cam FX2) - [CVE-2025-2348](https://cve.now/CVE-2025-2348.md): IROAD Dash Cam FX2 HTTP/RTSP event information disclosure (CVSS 5.3, IROAD Dash Cam FX2) - [CVE-2025-2347](https://cve.now/CVE-2025-2347.md): IROAD Dash Cam FX2 Device Registration default password (CVSS 5.3, IROAD Dash Cam FX2) - [CVE-2025-2346](https://cve.now/CVE-2025-2346.md): IROAD Dash Cam X5/Dash Cam X6 Domain origin validation (CVSS 6.3, IROAD Dash Cam X5 · IROAD Dash Cam X6) - [CVE-2025-2345](https://cve.now/CVE-2025-2345.md): IROAD Dash Cam X5/Dash Cam X6 improper authorization (CVSS 9.3, IROAD Dash Cam X5 · IROAD Dash Cam X6) - [CVE-2025-2344](https://cve.now/CVE-2025-2344.md): IROAD Dash Cam X5/Dash Cam X6 API Endpoint missing authentication (CVSS 6.9, IROAD Dash Cam X5 · IROAD Dash Cam X6) - [CVE-2025-2343](https://cve.now/CVE-2025-2343.md): IROAD Dash Cam X5/Dash Cam X6 Device Pairing hard-coded credentials (CVSS 7.7, IROAD Dash Cam X5 · IROAD Dash Cam X6) - [CVE-2025-2342](https://cve.now/CVE-2025-2342.md): IROAD X5 Mobile App API Endpoint hard-coded credentials (CVSS 6.9, IROAD X5 Mobile App) - [CVE-2025-2341](https://cve.now/CVE-2025-2341.md): IROAD Dash Cam X5 SSID default credentials (CVSS 2.3, IROAD Dash Cam X5) - [CVE-2025-2340](https://cve.now/CVE-2025-2340.md): otale Tale Blog Site Settings save saveOptions cross site scripting (CVSS 4.8, otale Tale Blog) - [CVE-2025-2339](https://cve.now/CVE-2025-2339.md): otale Tale Blog logs improper authentication (CVSS 6.9, otale Tale Blog) - [CVE-2025-2338](https://cve.now/CVE-2025-2338.md): tbeu matio io.c strdup\_vprintf heap-based overflow (CVSS 5.3, tbeu matio) - [CVE-2025-2337](https://cve.now/CVE-2025-2337.md): tbeu matio mat.c Mat\_VarPrint heap-based overflow (CVSS 5.3, tbeu matio) - [CVE-2025-1624](https://cve.now/CVE-2025-1624.md): GDPR Cookie Compliance \< 4.15.9 - Admin+ Stored XSS (CVSS 3.5, GDPR Cookie Compliance) - [CVE-2025-1623](https://cve.now/CVE-2025-1623.md): GDPR Cookie Compliance \< 4.15.9 - Admin+ Stored XSS (CVSS 3.5, GDPR Cookie Compliance) - [CVE-2025-1622](https://cve.now/CVE-2025-1622.md): GDPR Cookie Compliance \< 4.15.7 - Admin+ Stored XSS (CVSS 3.5, GDPR Cookie Compliance) - [CVE-2025-1621](https://cve.now/CVE-2025-1621.md): GDPR Cookie Compliance \< 4.15.7 - Admin+ Stored XSS (CVSS 4.8, GDPR Cookie Compliance) - [CVE-2025-1620](https://cve.now/CVE-2025-1620.md): GDPR Cookie Compliance \< 4.15.7 - Admin+ Stored XSS (CVSS 4.8, GDPR Cookie Compliance) - [CVE-2025-1619](https://cve.now/CVE-2025-1619.md): GDPR Cookie Compliance \< 4.15.7 - Admin+ Stored XSS (CVSS 4.8, GDPR Cookie Compliance) - [CVE-2024-13602](https://cve.now/CVE-2024-13602.md): Poll Maker \< 5.5.4 - Admin+ Stored XSS (CVSS 4.8, Poll Maker) - [CVE-2024-13126](https://cve.now/CVE-2024-13126.md): Download Manager \< 3.3.07 - Unauthenticated Data Exposure (CVSS 4.6, Download Manager) - [CVE-2025-2335](https://cve.now/CVE-2025-2335.md): Drivin Soluções API registerSchool cross site scripting (CVSS 5.1, Drivin Soluções) - [CVE-2022-49737](https://cve.now/CVE-2022-49737.md): In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data (CVSS 7.7, X.org X server) - [CVE-2024-58103](https://cve.now/CVE-2024-58103.md): Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt. (CVSS 5.8, Square Wire · com.squareup.wire:wire-runtime) - [CVE-2025-24856](https://cve.now/CVE-2025-24856.md): An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. (CVSS 4.2, TYPO3 oidc · causal/oidc) - [CVE-2025-30074](https://cve.now/CVE-2025-30074.md): Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM cr (CVSS 7.8, Parallels Desktop) - [CVE-2025-30076](https://cve.now/CVE-2025-30076.md): Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter. (CVSS 7.7, Koha) - [CVE-2025-30077](https://cve.now/CVE-2025-30077.md): Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of (CVSS 6.2, onosproject onos-lib-go · github.com/onosproject/onos-lib-go) - [CVE-2025-30089](https://cve.now/CVE-2025-30089.md): gurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences. (CVSS 5.4, boxdot gurk · gurk) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-03-16 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.