# CVEs published 2025-03-17

132 CVEs were published on March 17, 2025: 5 critical, 42 high. Days are UTC.

- [CVE-2025-2472](https://cve.now/CVE-2025-2472.md): PHPGurukul Apartment Visitors Management System Sign In index.php sql injection (CVSS 6.9, PHPGurukul Apartment Visitors Management System)
- [CVE-2025-2471](https://cve.now/CVE-2025-2471.md): PHPGurukul Boat Booking System boat-details.php sql injection (CVSS 5.3, PHPGurukul Boat Booking System)
- [CVE-2025-29913](https://cve.now/CVE-2025-29913.md): CryptoLib's Crypto\_TC\_Prep\_AAD Has Buffer Overflow Due to Integer Underflow (CVSS 8.9, nasa CryptoLib)
- [CVE-2025-29912](https://cve.now/CVE-2025-29912.md): CryptoLib Has Heap Buffer Overflow Due to Unsigned Integer Underflow in Crypto\_TC\_ProcessSecurity (CVSS 8.9, nasa CryptoLib)
- [CVE-2023-22512](https://cve.now/CVE-2023-22512.md): This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. (CVSS 7.5, Atlassian Confluence Data Center · Atlassian Confluence Ser…)
- [CVE-2025-2420](https://cve.now/CVE-2025-2420.md): 猫宁i Morning cross-site request forgery (CVSS 5.3, 猫宁i Morning)
- [CVE-2025-29911](https://cve.now/CVE-2025-29911.md): CryptoLib Has Heap Buffer Overflow in Crypto\_AOS\_ProcessSecurity Function (CVSS 8.9, nasa CryptoLib)
- [CVE-2025-29910](https://cve.now/CVE-2025-29910.md): CryptoLib's crypto\_handle\_incrementing\_nontransmitted\_counter Function has Memory Leak (CVSS 5.5, nasa CryptoLib)
- [CVE-2025-2419](https://cve.now/CVE-2025-2419.md): code-projects Real Estate Property Management System InsertFeedback.php sql injection (CVSS 5.3, code-projects Real Estate Property Management System)
- [CVE-2025-29909](https://cve.now/CVE-2025-29909.md): CryptoLib's Crypto\_TC\_ApplySecurity() Has a Heap Buffer Overflow Vulnerability (CVSS 8.9, nasa CryptoLib)
- [CVE-2025-29781](https://cve.now/CVE-2025-29781.md): Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD (CVSS 6.5, metal3-io baremetal-operator · github.com/metal3-io/baremet…)
- [CVE-2024-40635](https://cve.now/CVE-2024-40635.md): containerd has an integer overflow in User ID handling (CVSS 4.6, containerd · github.com/containerd/containerd +1)
- [CVE-2025-2398](https://cve.now/CVE-2025-2398.md): China Mobile P22g-CIac CLI su Command default credentials (CVSS 8.6, China Mobile P22g-CIac · China Mobile ZXWT-MIG-P4G4V +3)
- [CVE-2025-2397](https://cve.now/CVE-2025-2397.md): China Mobile P22g-CIac Telnet Service improper authorization (CVSS 4.8, China Mobile P22g-CIac · China Mobile ZXWT-MIG-P4G4V +3)
- [CVE-2025-2393](https://cve.now/CVE-2025-2393.md): code-projects Online Class and Exam Scheduling System salut\_del.php sql injection (CVSS 5.1, code-projects Online Class and Exam Scheduling System)
- [CVE-2025-26393](https://cve.now/CVE-2025-26393.md): SolarWinds Service Desk Broken Access Control Vulnerability (CVSS 5.4, SolarWinds Service Desk)
- [CVE-2025-2392](https://cve.now/CVE-2025-2392.md): code-projects Online Class and Exam Scheduling System activate.php sql injection (CVSS 5.1, code-projects Online Class and Exam Scheduling System)
- [CVE-2024-44276](https://cve.now/CVE-2024-44276.md): This issue was addressed by using HTTPS when sending information over the network. (CVSS 7.3, Apple iOS and iPadOS)
- [CVE-2025-24185](https://cve.now/CVE-2025-24185.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2024-54559](https://cve.now/CVE-2024-54559.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-54525](https://cve.now/CVE-2024-54525.md): A logic issue was addressed with improved file handling. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-54565](https://cve.now/CVE-2024-54565.md): The issue was addressed with improved checks. (CVSS 6.2, Apple macOS)
- [CVE-2025-2391](https://cve.now/CVE-2025-2391.md): code-projects Blood Bank Management System Admin Login Page admin\_login.php sql injection (CVSS 6.9, code-projects Blood Bank Management System)
- [CVE-2025-0495](https://cve.now/CVE-2025-0495.md): Secrets leakage to telemetry endpoint via cache backend configuration via buildx (CVSS 4.1, docker buildx · github.com/docker/buildx)
- [CVE-2024-8510](https://cve.now/CVE-2024-8510.md): N-central Path Traversal (CVSS 5.3, N-able N-central)
- [CVE-2025-2390](https://cve.now/CVE-2025-2390.md): code-projects Blood Bank Management System add\_donor.php sql injection (CVSS 5.3, code-projects Blood Bank Management System)
- [CVE-2025-2389](https://cve.now/CVE-2025-2389.md): code-projects Blood Bank Management System add\_city.php sql injection (CVSS 5.1, code-projects Blood Bank Management System)
- [CVE-2024-48831](https://cve.now/CVE-2024-48831.md): Dell SmartFabric OS10 Software, version(s) 10.5.6.x, contain(s) a Use of Hard-coded Password vulnerability. (CVSS 8.4, Dell SmartFabric OS10 Software)
- [CVE-2025-2388](https://cve.now/CVE-2025-2388.md): Keytop 路内停车收费系统 API getParks improper authentication (CVSS 6.9, Keytop 路内停车收费系统)
- [CVE-2025-22472](https://cve.now/CVE-2025-22472.md): Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements (CVSS 7.8, Dell SmartFabric OS10 Software)
- [CVE-2025-22473](https://cve.now/CVE-2025-22473.md): Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements (CVSS 7.8, Dell SmartFabric OS10 Software)
- [CVE-2024-49561](https://cve.now/CVE-2024-49561.md): Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Incorrect Privilege Assignment vulnerabilit (CVSS 7.8, Dell SmartFabric OS10 Software)
- [CVE-2025-2387](https://cve.now/CVE-2025-2387.md): SourceCodester Online Food Ordering System ajax.php sql injection (CVSS 6.9, SourceCodester Online Food Ordering System)
- [CVE-2024-49559](https://cve.now/CVE-2024-49559.md): Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Use of Default Password vulnerability. (CVSS 8.8, Dell SmartFabric OS10 Software)
- [CVE-2024-48017](https://cve.now/CVE-2024-48017.md): Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements (CVSS 6.5, Dell SmartFabric OS10 Software)
- [CVE-2024-48015](https://cve.now/CVE-2024-48015.md): Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements (CVSS 6.7, Dell SmartFabric OS10 Software)
- [CVE-2024-48828](https://cve.now/CVE-2024-48828.md): Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Privilege Management vulnerability (CVSS 5.5, Dell SmartFabric OS10 Software)
- [CVE-2025-22474](https://cve.now/CVE-2025-22474.md): Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) a Server-Side Request Forgery (SSRF) vulnerabi (CVSS 6.8, Dell SmartFabric OS10 Software)
- [CVE-2025-2386](https://cve.now/CVE-2025-2386.md): PHPGurukul Local Services Search Engine Management System serviceman-search.php sql injection (CVSS 6.9, PHPGurukul Local Services Search Engine Management System)
- [CVE-2024-48830](https://cve.now/CVE-2024-48830.md): Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements (CVSS 7.8, Dell SmartFabric OS10 Software)
- [CVE-2024-48013](https://cve.now/CVE-2024-48013.md): Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Execution with Unnecessary Privileges vulne (CVSS 8.8, Dell SmartFabric OS10 Software)
- [CVE-2025-2385](https://cve.now/CVE-2025-2385.md): code-projects Modern Bag login.php sql injection (CVSS 6.9, code-projects Modern Bag)
- [CVE-2025-2241](https://cve.now/CVE-2025-2241.md): Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm (CVSS 8.2, hive · Red Hat Multicluster Engine for Kubernetes +2)
- [CVE-2025-2384](https://cve.now/CVE-2025-2384.md): code-projects Real Estate Property Management System Parameter InsertCustomer.php sql injection (CVSS 5.3, code-projects Real Estate Property Management System)
- [CVE-2025-2383](https://cve.now/CVE-2025-2383.md): PHPGurukul Doctor Appointment Management System search.php sql injection (CVSS 6.9, PHPGurukul Doctor Appointment Management System)
- [CVE-2025-1774](https://cve.now/CVE-2025-1774.md): Logs manipulation in BotSense (CVSS 6.3, NASK - PIB BotSense)
- [CVE-2025-2382](https://cve.now/CVE-2025-2382.md): PHPGurukul Online Banquet Booking System booking-search.php sql injection (CVSS 6.9, PHPGurukul Online Banquet Booking System)
- [CVE-2025-27512](https://cve.now/CVE-2025-27512.md): Zincati allows unprivileged access to rpm-ostree D-Bus \`Deploy()\` and \`FinalizeDeployment()\` methods (CVSS 2.1, coreos zincati · zincati)
- [CVE-2025-2381](https://cve.now/CVE-2025-2381.md): PHPGurukul Curfew e-Pass Management System search-pass.php sql injection (CVSS 6.9, PHPGurukul Curfew e-Pass Management System)
- [CVE-2025-1398](https://cve.now/CVE-2025-1398.md): macOS TCC Bypass via Code Injection (CVSS 3.3, Mattermost · mattermost-desktop)
- [CVE-2025-2380](https://cve.now/CVE-2025-2380.md): PHPGurukul Apartment Visitors Management System admin-profile.php sql injection (CVSS 6.9, PHPGurukul Apartment Visitors Management System)
- [CVE-2025-0833](https://cve.now/CVE-2025-0833.md): Stored Cross-site Scripting (XSS) vulnerability affecting Route Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2025-0832](https://cve.now/CVE-2025-0832.md): Stored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2025-0830](https://cve.now/CVE-2025-0830.md): Stored Cross-site Scripting (XSS) vulnerability affecting Meeting Management in ENOVIA Change Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Change Manager)
- [CVE-2025-0829](https://cve.now/CVE-2025-0829.md): Stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2025-0828](https://cve.now/CVE-2025-0828.md): Stored Cross-site Scripting (XSS) vulnerability affecting Engineering Release in ENOVIA Product Engineering Specialist from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Product Engineering Specialist)
- [CVE-2025-0827](https://cve.now/CVE-2025-0827.md): Stored Cross-site Scripting (XSS) vulnerability affecting 3DPlay in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes 3DSwymer)
- [CVE-2025-0826](https://cve.now/CVE-2025-0826.md): Stored Cross-site Scripting (XSS) vulnerability affecting 3D Navigate in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2025-0601](https://cve.now/CVE-2025-0601.md): Stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2025-0600](https://cve.now/CVE-2025-0600.md): Stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2025-0599](https://cve.now/CVE-2025-0599.md): Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2025-0598](https://cve.now/CVE-2025-0598.md): Stored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2025-0596](https://cve.now/CVE-2025-0596.md): Stored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2025-0595](https://cve.now/CVE-2025-0595.md): Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes 3DSwymer)
- [CVE-2024-9055](https://cve.now/CVE-2024-9055.md): DPA Countermeasures need reseeding (CVSS 4.2, Silicon Labs Simplicity SDK)
- [CVE-2019-6697](https://cve.now/CVE-2019-6697.md): An Improper Neutralization of Input vulnerability affecting FortiGate version 6.2.0 through 6.2.1, 6.0.0 through 6.0.6 in the hostname param (CVSS 5.2, Fortinet FortiOS)
- [CVE-2020-9295](https://cve.now/CVE-2020-9295.md): FortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and FortiClient 6.2 running (CVSS 4.7, Fortinet FortiClientWindows)
- [CVE-2025-2379](https://cve.now/CVE-2025-2379.md): PHPGurukul Apartment Visitors Management System create-pass.php sql injection (CVSS 6.9, PHPGurukul Apartment Visitors Management System)
- [CVE-2025-29788](https://cve.now/CVE-2025-29788.md): Sylius PayPal Plugin Payment Amount Manipulation Vulnerability (CVSS 6.5, Sylius PayPalPlugin · sylius/paypal-plugin)
- [CVE-2025-29787](https://cve.now/CVE-2025-29787.md): zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write (CVSS 7.3, zip-rs zip2 · zip)
- [CVE-2025-29786](https://cve.now/CVE-2025-29786.md): Memory Exhaustion in Expr Parser with Unrestricted Input (CVSS 7.5, expr-lang expr · github.com/expr-lang/expr)
- [CVE-2025-27102](https://cve.now/CVE-2025-27102.md): Agate vulnerable to HTML injection in user signup - Administrator phishing risk (CVSS 5.4, obiba agate)
- [CVE-2020-29010](https://cve.now/CVE-2020-29010.md): An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay (CVSS 4.9, Fortinet FortiOS)
- [CVE-2019-17659](https://cve.now/CVE-2019-17659.md): A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH acc (CVSS 3.6, Fortinet FortiSIEM)
- [CVE-2021-22126](https://cve.now/CVE-2021-22126.md): A use of hard-coded password vulnerability in FortiWLC version 8.5.2 and below, version 8.4.8 and below, version 8.3.3 to 8.3.2, version 8.2 (CVSS 6.5, Fortinet FortiWLC)
- [CVE-2021-32584](https://cve.now/CVE-2021-32584.md): An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3. (CVSS 4.8, Fortinet FortiWLC)
- [CVE-2024-54027](https://cve.now/CVE-2024-54027.md): A Use of Hard-coded Cryptographic Key vulnerability \[CWE-321\] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0. (CVSS 7.8, Fortinet FortiSandbox)
- [CVE-2021-26087](https://cve.now/CVE-2021-26087.md): An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, (CVSS 4.2, Fortinet FortiWLC)
- [CVE-2019-15706](https://cve.now/CVE-2019-15706.md): An improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy version 2.0.0, version 1.2.9 and below an (CVSS 4.0, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2025-2378](https://cve.now/CVE-2025-2378.md): PHPGurukul Medical Card Generation System download-medical-cards.php sql injection (CVSS 6.9, PHPGurukul Medical Card Generation System)
- [CVE-2025-2377](https://cve.now/CVE-2025-2377.md): SourceCodester Vehicle Management System confirmbooking.php cross site scripting (CVSS 5.1, SourceCodester Vehicle Management System)
- [CVE-2025-2401](https://cve.now/CVE-2025-2401.md): Buffer overflow in Immunity Debugger (CVSS 5.4, Immunity Debugger)
- [CVE-2025-2376](https://cve.now/CVE-2025-2376.md): viames Pair Framework PHP Object UserRemember.php getCookieContent deserialization (CVSS 6.9, viames Pair Framework)
- [CVE-2025-2375](https://cve.now/CVE-2025-2375.md): PHPGurukul Human Metapneumovirus Testing Management System Admin Profile Page profile.php cross site scripting (CVSS 5.1, PHPGurukul Human Metapneumovirus Testing Management System)
- [CVE-2025-2374](https://cve.now/CVE-2025-2374.md): PHPGurukul Human Metapneumovirus Testing Management System profile.php sql injection (CVSS 5.3, PHPGurukul Human Metapneumovirus Testing Management System)
- [CVE-2025-2373](https://cve.now/CVE-2025-2373.md): PHPGurukul Human Metapneumovirus Testing Management System check\_availability.php sql injection (CVSS 5.3, PHPGurukul Human Metapneumovirus Testing Management System)
- [CVE-2025-2202](https://cve.now/CVE-2025-2202.md): Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php (CVSS 6.9, Innovación y Cualificación ajax.php plugin)
- [CVE-2025-2201](https://cve.now/CVE-2025-2201.md): Broken access control vulnerability in the Innovación y Cualificación IcProgreso plugin (CVSS 6.9, Innovación y Cualificación IcProgreso plugin)
- [CVE-2025-2200](https://cve.now/CVE-2025-2200.md): SQL injection vulnerability in the Innovación y Cualificación IcProgreso plugin (CVSS 9.3, Innovación y Cualificación IcProgreso plugin)
- [CVE-2025-2199](https://cve.now/CVE-2025-2199.md): SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php (CVSS 9.3, Innovación y Cualificación ajax.php plugin)
- [CVE-2025-2372](https://cve.now/CVE-2025-2372.md): PHPGurukul Human Metapneumovirus Testing Management System Password Recovery Page password-recovery.php sql injection (CVSS 6.9, PHPGurukul Human Metapneumovirus Testing Management System)
- [CVE-2025-2371](https://cve.now/CVE-2025-2371.md): PHPGurukul Human Metapneumovirus Testing Management System Registered Mobile Number Search registered-user-testing.php cross site scripting (CVSS 5.1, PHPGurukul Human Metapneumovirus Testing Management System)
- [CVE-2024-12992](https://cve.now/CVE-2024-12992.md): Remote Code Execution leads to Command Injection (CVSS 8.6, Pandora FMS)
- [CVE-2024-12971](https://cve.now/CVE-2024-12971.md): QuickShell Authenticated Command Injection (CVSS 8.6, Pandora FMS)
- [CVE-2025-2370](https://cve.now/CVE-2025-2370.md): TOTOLINK EX1800T cstecgi.cgi setWiFiExtenderConfig stack-based overflow (CVSS 8.7, TOTOLINK EX1800T)
- [CVE-2025-2369](https://cve.now/CVE-2025-2369.md): TOTOLINK EX1800T cstecgi.cgi setPasswordCfg stack-based overflow (CVSS 8.7, TOTOLINK EX1800T)
- [CVE-2025-2368](https://cve.now/CVE-2025-2368.md): WebAssembly wabt Malformed File binary-reader-interp.cc OnExport heap-based overflow (CVSS 5.3, WebAssembly wabt · wabt-bin)
- [CVE-2025-2367](https://cve.now/CVE-2025-2367.md): Oiwtech OIW-2431APGN-HP Personal Script Submenu formScript os command injection (CVSS 5.3, Oiwtech OIW-2431APGN-HP)
- [CVE-2025-2366](https://cve.now/CVE-2025-2366.md): gougucms Add Department Page add cross site scripting (CVSS 4.8, gougucms)
- [CVE-2025-1724](https://cve.now/CVE-2025-1724.md): Account Takeover (CVSS 7.4, Zohocorp Analytics Plus)
- [CVE-2025-2365](https://cve.now/CVE-2025-2365.md): crmeb\_java WeChatMessageController.java webHook xml external entity reference (CVSS 5.3, crmeb\_java)
- [CVE-2025-2364](https://cve.now/CVE-2025-2364.md): lenve VBlog ArticleService.java addNewArticle cross site scripting (CVSS 5.1, lenve VBlog)
- [CVE-2025-2396](https://cve.now/CVE-2025-2396.md): e-Excellence U-Office Force - Arbitrary File Upload (CVSS 8.8, e-Excellence U-Office Force)
- [CVE-2025-2395](https://cve.now/CVE-2025-2395.md): e-Excellence U-Office Force - Improper Authentication (CVSS 9.8, e-Excellence U-Office Force)
- [CVE-2025-2363](https://cve.now/CVE-2025-2363.md): lenve VBlog ArticleController.java uploadImg path traversal (CVSS 5.3, lenve VBlog)
- [CVE-2025-2362](https://cve.now/CVE-2025-2362.md): PHPGurukul Pre-School Enrollment System contact-us.php sql injection (CVSS 6.9, PHPGurukul Pre-School Enrollment System)
- [CVE-2025-2361](https://cve.now/CVE-2025-2361.md): Mercurial SCM Web Interface cross site scripting (CVSS 5.3, Mercurial SCM)
- [CVE-2025-2360](https://cve.now/CVE-2025-2360.md): D-Link DIR-823G UPnP Service HNAP1 SetUpnpSettings improper authorization (CVSS 6.9, D-Link DIR-823G)
- [CVE-2025-2359](https://cve.now/CVE-2025-2359.md): D-Link DIR-823G DDNS Service HNAP1 SetDDNSSettings improper authorization (CVSS 6.9, D-Link DIR-823G)
- [CVE-2025-2358](https://cve.now/CVE-2025-2358.md): Shenzhen Mingyuan Cloud Technology Mingyuan Real Estate ERP System HTTP Header Service.asmx sql injection (CVSS 5.3, Shenzhen Mingyuan Cloud Technology Mingyuan Real Estate ERP…)
- [CVE-2025-2357](https://cve.now/CVE-2025-2357.md): DCMTK dcmjpls JPEG-LS Decoder memory corruption (CVSS 5.3, DCMTK)
- [CVE-2025-2356](https://cve.now/CVE-2025-2356.md): BlackVue App API deviceDelete get request method with sensitive query strings (CVSS 6.3, BlackVue App)
- [CVE-2025-2355](https://cve.now/CVE-2025-2355.md): BlackVue App API Endpoint credentials storage (CVSS 4.8, BlackVue App)
- [CVE-2025-2354](https://cve.now/CVE-2025-2354.md): VAM Virtual Airlines Manager index.php cross site scripting (CVSS 5.3, VAM Virtual Airlines Manager)
- [CVE-2024-44866](https://cve.now/CVE-2024-44866.md): A buffer overflow in the GuitarPro1::read function of MuseScore Studio v4.3.2 allows attackers to to execute arbitrary code or cause a Denia (CVSS 6.8)
- [CVE-2025-25612](https://cve.now/CVE-2025-25612.md): FS Inc S3150-8T2F prior to version S3150-8T2F\_2.2.0D\_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration func (CVSS 7.1)
- [CVE-2025-25618](https://cve.now/CVE-2025-25618.md): Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teache (CVSS 3.3)
- [CVE-2025-25621](https://cve.now/CVE-2025-25621.md): Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers. (CVSS 4.3)
- [CVE-2025-25650](https://cve.now/CVE-2025-25650.md): An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5\_433WBSK\_v2.2\_220605 allows attackers to produce cloned NFC cards t (CVSS 9.1)
- [CVE-2025-25684](https://cve.now/CVE-2025-25684.md): A lack of validation in the path parameter (/download) of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files fro (CVSS 7.5)
- [CVE-2025-25685](https://cve.now/CVE-2025-25685.md): An issue was discovered in GL-INet Beryl AX GL-MT3000 v4.7.0. (CVSS 7.5)
- [CVE-2025-25914](https://cve.now/CVE-2025-25914.md): SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter (CVSS 9.8)
- [CVE-2025-26042](https://cve.now/CVE-2025-26042.md): Uptime Kuma \>== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. (CVSS 6.0, uptime-kuma)
- [CVE-2025-26125](https://cve.now/CVE-2025-26125.md): An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate pri (CVSS 7.3)
- [CVE-2025-26127](https://cve.now/CVE-2025-26127.md): A stored cross-site scripting (XSS) vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbit (CVSS 5.0)
- [CVE-2025-29425](https://cve.now/CVE-2025-29425.md): Code-projects Online Class and Exam Scheduling System 1.0 is vulnerable to SQL Injection in exam\_save.php via the parameters member and firs (CVSS 5.5)
- [CVE-2025-29426](https://cve.now/CVE-2025-29426.md): Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/class.php via the id and cy (CVSS 4.6)
- [CVE-2025-29427](https://cve.now/CVE-2025-29427.md): Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in profile.php via the member\_first a (CVSS 5.9)
- [CVE-2025-29429](https://cve.now/CVE-2025-29429.md): Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/program.php via the id, cod (CVSS 6.1)
- [CVE-2025-29430](https://cve.now/CVE-2025-29430.md): Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/room.php via the id and rom (CVSS 4.1)
- [CVE-2025-29431](https://cve.now/CVE-2025-29431.md): Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/department.php via the id, (CVSS 3.2)
- [CVE-2025-30143](https://cve.now/CVE-2025-30143.md): Rule 3000216 (before version 2) in Akamai App & API Protector (with Akamai ASE) before 2024-12-10 does not properly consider JavaScript vari (CVSS 5.4, Akamai App & API Protector)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.