CVEs published March 17, 2025
132 CVEs were published on March 17, 2025: 5 critical, 42 high.
- Published
- 132
- Critical
- 5
- High
- 42
- Medium
- 80
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Dell SmartFabric OS10 Software
- 11
- Dassault Systèmes ENOVIA Collaborative Industry Innovator
- 9
- nasa CryptoLib
- 5
- PHPGurukul Human Metapneumovirus Testing Management System
- 5
- Apple macOS
- 3
- code-projects Blood Bank Management System
- 3
- Fortinet FortiWLC
- 3
- PHPGurukul Apartment Visitors Management System
- 3
- BlackVue App
- 2
- China Mobile P22g-CIac · China Mobile ZXWT-MIG-P4G4V +3
- 2
Critical 5
- CVE-2025-2200SQL injection vulnerability in the Innovación y Cualificación IcProgreso pluginInnovación y Cualificación IcProgreso plugin
- CVE-2025-2199SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.phpInnovación y Cualificación ajax.php plugin
- CVE-2025-2395e-Excellence U-Office Force - Improper Authenticatione-Excellence U-Office Force
- CVE-2025-25650An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards t
- CVE-2025-25914SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter
High 42
- CVE-2025-29913CryptoLib's Crypto_TC_Prep_AAD Has Buffer Overflow Due to Integer Underflownasa CryptoLib
- CVE-2025-29912CryptoLib Has Heap Buffer Overflow Due to Unsigned Integer Underflow in Crypto_TC_ProcessSecuritynasa CryptoLib
- CVE-2023-22512This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server.Atlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2025-29911CryptoLib Has Heap Buffer Overflow in Crypto_AOS_ProcessSecurity Functionnasa CryptoLib
- CVE-2025-29909CryptoLib's Crypto_TC_ApplySecurity() Has a Heap Buffer Overflow Vulnerabilitynasa CryptoLib
- CVE-2025-2398China Mobile P22g-CIac CLI su Command default credentialsChina Mobile P22g-CIac · China Mobile ZXWT-MIG-P4G4V +3
- CVE-2024-44276This issue was addressed by using HTTPS when sending information over the network.Apple iOS and iPadOS
- CVE-2024-54525A logic issue was addressed with improved file handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-48831Dell SmartFabric OS10 Software, version(s) 10.5.6.x, contain(s) a Use of Hard-coded Password vulnerability.Dell SmartFabric OS10 Software
- CVE-2025-22472Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special ElementsDell SmartFabric OS10 Software
- CVE-2025-22473Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special ElementsDell SmartFabric OS10 Software
- CVE-2024-49561Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Incorrect Privilege Assignment vulnerabilitDell SmartFabric OS10 Software
- CVE-2024-49559Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Use of Default Password vulnerability.Dell SmartFabric OS10 Software
- CVE-2024-48830Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special ElementsDell SmartFabric OS10 Software
- CVE-2024-48013Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Execution with Unnecessary Privileges vulneDell SmartFabric OS10 Software
- CVE-2025-2241Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acmhive · Red Hat Multicluster Engine for Kubernetes +2
- CVE-2025-0833Stored Cross-site Scripting (XSS) vulnerability affecting Route Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2025-0832Stored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2025-0830Stored Cross-site Scripting (XSS) vulnerability affecting Meeting Management in ENOVIA Change Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Change Manager
- CVE-2025-0829Stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2025-0828Stored Cross-site Scripting (XSS) vulnerability affecting Engineering Release in ENOVIA Product Engineering Specialist from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Product Engineering Specialist
- CVE-2025-0827Stored Cross-site Scripting (XSS) vulnerability affecting 3DPlay in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes 3DSwymer
- CVE-2025-0826Stored Cross-site Scripting (XSS) vulnerability affecting 3D Navigate in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2025-0601Stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2025-0600Stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2025-0599Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2025-0598Stored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2025-0596Stored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2025-0595Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes 3DSwymer
- CVE-2025-29787zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Writezip-rs zip2 · zip
- CVE-2025-29786Memory Exhaustion in Expr Parser with Unrestricted Inputexpr-lang expr · github.com/expr-lang/expr
- CVE-2024-54027A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.Fortinet FortiSandbox
- CVE-2024-12992Remote Code Execution leads to Command InjectionPandora FMS
- CVE-2024-12971QuickShell Authenticated Command InjectionPandora FMS
- CVE-2025-2370TOTOLINK EX1800T cstecgi.cgi setWiFiExtenderConfig stack-based overflowTOTOLINK EX1800T
- CVE-2025-2369TOTOLINK EX1800T cstecgi.cgi setPasswordCfg stack-based overflowTOTOLINK EX1800T
- CVE-2025-1724Account TakeoverZohocorp Analytics Plus
- CVE-2025-2396e-Excellence U-Office Force - Arbitrary File Uploade-Excellence U-Office Force
- CVE-2025-25612FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration func
- CVE-2025-25684A lack of validation in the path parameter (/download) of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files fro
- CVE-2025-25685An issue was discovered in GL-INet Beryl AX GL-MT3000 v4.7.0.
- CVE-2025-26125An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate pri
Medium, low and unrated 85
- CVE-2025-2472PHPGurukul Apartment Visitors Management System Sign In index.php sql injectionPHPGurukul Apartment Visitors Management System
- CVE-2025-2471PHPGurukul Boat Booking System boat-details.php sql injectionPHPGurukul Boat Booking System
- CVE-2025-2420猫宁i Morning cross-site request forgery猫宁i Morning
- CVE-2025-29910CryptoLib's crypto_handle_incrementing_nontransmitted_counter Function has Memory Leaknasa CryptoLib
- CVE-2025-2419code-projects Real Estate Property Management System InsertFeedback.php sql injectioncode-projects Real Estate Property Management System
- CVE-2025-29781Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRDmetal3-io baremetal-operator · github.com/metal3-io/baremet…
- CVE-2024-40635containerd has an integer overflow in User ID handlingcontainerd · github.com/containerd/containerd +1
- CVE-2025-2397China Mobile P22g-CIac Telnet Service improper authorizationChina Mobile P22g-CIac · China Mobile ZXWT-MIG-P4G4V +3
- CVE-2025-2393code-projects Online Class and Exam Scheduling System salut_del.php sql injectioncode-projects Online Class and Exam Scheduling System
- CVE-2025-26393SolarWinds Service Desk Broken Access Control VulnerabilitySolarWinds Service Desk
- CVE-2025-2392code-projects Online Class and Exam Scheduling System activate.php sql injectioncode-projects Online Class and Exam Scheduling System
- CVE-2025-24185An out-of-bounds write issue was addressed with improved input validation.Apple macOS
- CVE-2024-54559The issue was addressed with improved checks.Apple macOS
- CVE-2024-54565The issue was addressed with improved checks.Apple macOS
- CVE-2025-2391code-projects Blood Bank Management System Admin Login Page admin_login.php sql injectioncode-projects Blood Bank Management System
- CVE-2025-0495Secrets leakage to telemetry endpoint via cache backend configuration via buildxdocker buildx · github.com/docker/buildx
- CVE-2024-8510N-central Path TraversalN-able N-central
- CVE-2025-2390code-projects Blood Bank Management System add_donor.php sql injectioncode-projects Blood Bank Management System
- CVE-2025-2389code-projects Blood Bank Management System add_city.php sql injectioncode-projects Blood Bank Management System
- CVE-2025-2388Keytop 路内停车收费系统 API getParks improper authenticationKeytop 路内停车收费系统
- CVE-2025-2387SourceCodester Online Food Ordering System ajax.php sql injectionSourceCodester Online Food Ordering System
- CVE-2024-48017Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special ElementsDell SmartFabric OS10 Software
- CVE-2024-48015Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special ElementsDell SmartFabric OS10 Software
- CVE-2024-48828Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Privilege Management vulnerabilityDell SmartFabric OS10 Software
- CVE-2025-22474Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) a Server-Side Request Forgery (SSRF) vulnerabiDell SmartFabric OS10 Software
- CVE-2025-2386PHPGurukul Local Services Search Engine Management System serviceman-search.php sql injectionPHPGurukul Local Services Search Engine Management System
- CVE-2025-2385code-projects Modern Bag login.php sql injectioncode-projects Modern Bag
- CVE-2025-2384code-projects Real Estate Property Management System Parameter InsertCustomer.php sql injectioncode-projects Real Estate Property Management System
- CVE-2025-2383PHPGurukul Doctor Appointment Management System search.php sql injectionPHPGurukul Doctor Appointment Management System
- CVE-2025-1774Logs manipulation in BotSenseNASK - PIB BotSense
- CVE-2025-2382PHPGurukul Online Banquet Booking System booking-search.php sql injectionPHPGurukul Online Banquet Booking System
- CVE-2025-27512Zincati allows unprivileged access to rpm-ostree D-Bus `Deploy()` and `FinalizeDeployment()` methodscoreos zincati · zincati
- CVE-2025-2381PHPGurukul Curfew e-Pass Management System search-pass.php sql injectionPHPGurukul Curfew e-Pass Management System
- CVE-2025-1398macOS TCC Bypass via Code InjectionMattermost · mattermost-desktop
- CVE-2025-2380PHPGurukul Apartment Visitors Management System admin-profile.php sql injectionPHPGurukul Apartment Visitors Management System
- CVE-2024-9055DPA Countermeasures need reseedingSilicon Labs Simplicity SDK
- CVE-2019-6697An Improper Neutralization of Input vulnerability affecting FortiGate version 6.2.0 through 6.2.1, 6.0.0 through 6.0.6 in the hostname paramFortinet FortiOS
- CVE-2020-9295FortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and FortiClient 6.2 runningFortinet FortiClientWindows
- CVE-2025-2379PHPGurukul Apartment Visitors Management System create-pass.php sql injectionPHPGurukul Apartment Visitors Management System
- CVE-2025-29788Sylius PayPal Plugin Payment Amount Manipulation VulnerabilitySylius PayPalPlugin · sylius/paypal-plugin
- CVE-2025-27102Agate vulnerable to HTML injection in user signup - Administrator phishing riskobiba agate
- CVE-2020-29010An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay Fortinet FortiOS
- CVE-2019-17659A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH accFortinet FortiSIEM
- CVE-2021-22126A use of hard-coded password vulnerability in FortiWLC version 8.5.2 and below, version 8.4.8 and below, version 8.3.3 to 8.3.2, version 8.2Fortinet FortiWLC
- CVE-2021-32584An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.Fortinet FortiWLC
- CVE-2021-26087An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, Fortinet FortiWLC
- CVE-2019-15706An improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy version 2.0.0, version 1.2.9 and below anFortinet FortiProxy · Fortinet FortiOS
- CVE-2025-2378PHPGurukul Medical Card Generation System download-medical-cards.php sql injectionPHPGurukul Medical Card Generation System
- CVE-2025-2377SourceCodester Vehicle Management System confirmbooking.php cross site scriptingSourceCodester Vehicle Management System
- CVE-2025-2401Buffer overflow in Immunity DebuggerImmunity Debugger
- CVE-2025-2376viames Pair Framework PHP Object UserRemember.php getCookieContent deserializationviames Pair Framework
- CVE-2025-2375PHPGurukul Human Metapneumovirus Testing Management System Admin Profile Page profile.php cross site scriptingPHPGurukul Human Metapneumovirus Testing Management System
- CVE-2025-2374PHPGurukul Human Metapneumovirus Testing Management System profile.php sql injectionPHPGurukul Human Metapneumovirus Testing Management System
- CVE-2025-2373PHPGurukul Human Metapneumovirus Testing Management System check_availability.php sql injectionPHPGurukul Human Metapneumovirus Testing Management System
- CVE-2025-2202Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.phpInnovación y Cualificación ajax.php plugin
- CVE-2025-2201Broken access control vulnerability in the Innovación y Cualificación IcProgreso pluginInnovación y Cualificación IcProgreso plugin
- CVE-2025-2372PHPGurukul Human Metapneumovirus Testing Management System Password Recovery Page password-recovery.php sql injectionPHPGurukul Human Metapneumovirus Testing Management System
- CVE-2025-2371PHPGurukul Human Metapneumovirus Testing Management System Registered Mobile Number Search registered-user-testing.php cross site scriptingPHPGurukul Human Metapneumovirus Testing Management System
- CVE-2025-2368WebAssembly wabt Malformed File binary-reader-interp.cc OnExport heap-based overflowWebAssembly wabt · wabt-bin
- CVE-2025-2367Oiwtech OIW-2431APGN-HP Personal Script Submenu formScript os command injectionOiwtech OIW-2431APGN-HP
- CVE-2025-2366gougucms Add Department Page add cross site scriptinggougucms
- CVE-2025-2365crmeb_java WeChatMessageController.java webHook xml external entity referencecrmeb_java
- CVE-2025-2364lenve VBlog ArticleService.java addNewArticle cross site scriptinglenve VBlog
- CVE-2025-2363lenve VBlog ArticleController.java uploadImg path traversallenve VBlog
- CVE-2025-2362PHPGurukul Pre-School Enrollment System contact-us.php sql injectionPHPGurukul Pre-School Enrollment System
- CVE-2025-2361Mercurial SCM Web Interface cross site scriptingMercurial SCM
- CVE-2025-2360D-Link DIR-823G UPnP Service HNAP1 SetUpnpSettings improper authorizationD-Link DIR-823G
- CVE-2025-2359D-Link DIR-823G DDNS Service HNAP1 SetDDNSSettings improper authorizationD-Link DIR-823G
- CVE-2025-2358Shenzhen Mingyuan Cloud Technology Mingyuan Real Estate ERP System HTTP Header Service.asmx sql injectionShenzhen Mingyuan Cloud Technology Mingyuan Real Estate ERP…
- CVE-2025-2357DCMTK dcmjpls JPEG-LS Decoder memory corruptionDCMTK
- CVE-2025-2356BlackVue App API deviceDelete get request method with sensitive query stringsBlackVue App
- CVE-2025-2355BlackVue App API Endpoint credentials storageBlackVue App
- CVE-2025-2354VAM Virtual Airlines Manager index.php cross site scriptingVAM Virtual Airlines Manager
- CVE-2024-44866A buffer overflow in the GuitarPro1::read function of MuseScore Studio v4.3.2 allows attackers to to execute arbitrary code or cause a Denia
- CVE-2025-25618Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teache
- CVE-2025-25621Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers.
- CVE-2025-26042Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service.uptime-kuma
- CVE-2025-26127A stored cross-site scripting (XSS) vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbit
- CVE-2025-29425Code-projects Online Class and Exam Scheduling System 1.0 is vulnerable to SQL Injection in exam_save.php via the parameters member and firs
- CVE-2025-29426Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/class.php via the id and cy
- CVE-2025-29427Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in profile.php via the member_first a
- CVE-2025-29429Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/program.php via the id, cod
- CVE-2025-29430Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/room.php via the id and rom
- CVE-2025-29431Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/department.php via the id,
- CVE-2025-30143Rule 3000216 (before version 2) in Akamai App & API Protector (with Akamai ASE) before 2024-12-10 does not properly consider JavaScript variAkamai App & API Protector