CVEs published March 18, 2025
71 CVEs were published on March 18, 2025: 15 critical, 31 high.
- Published
- 71
- Critical
- 15
- High
- 31
- Medium
- 24
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- glpi-project glpi
- 3
- Hewlett Packard Enterprise (HPE) AOS-CX
- 3
- Sytel Softdial Contact Center
- 3
- Dromara ujcms
- 2
- FUJI SOFT INCORPORATED +F FS010M
- 2
- IBM AIX
- 2
- MB connect line mbCONNECT24 · MB connect line mbNET +2
- 2
- tastyigniter/tastyigniter
- 2
- 389-ds-base · Red Hat Directory Server 12.4 EUS for RHEL +2
- 1
- Atlassian Sourcetree for Mac · Atlassian Sourcetree for Win…
- 1
Critical 15
- CVE-2024-56347IBM AIX command executionIBM AIX
- CVE-2024-56346IBM AIX command executionIBM AIX
- CVE-2023-47539An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may alFortinet FortiMail
- CVE-2024-8997SQLi in Vestel's EVC04 Configuration InterfaceVestel EVC04 Configuration Interface
- CVE-2024-23943MB connect line: Cloud API access due to a lack of authentication for a critical functionMB connect line mbCONNECT24 · MB connect line mbNET +2
- CVE-2024-57169A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php.
- CVE-2025-25595A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack.
- CVE-2025-30113An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820.
- CVE-2025-30114An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820.
- CVE-2025-30115An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820.
- CVE-2025-30122An issue was discovered on ROADCAM X3 devices.
- CVE-2025-30123An issue was discovered on ROADCAM X3 devices.
- CVE-2025-30132An issue was discovered on IROAD Dashcam V devices.
- CVE-2025-30137An issue was discovered in the G-Net GNET APK 2.6.2.
- CVE-2025-30139An issue was discovered on G-Net Dashcam BB GONX devices.
High 31
- CVE-2024-12563s2Member Pro <= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via ShortcodeWP Sharks s2Member Pro
- CVE-2025-29907jsPDF Bypass Regular Expression Denial of Service (ReDoS)parallax jsPDF · jspdf
- CVE-2025-24801GLPI allows authenticated remote code executionglpi-project glpi
- CVE-2025-24799GLPI allows unauthenticated SQL injection through the inventory endpointglpi-project glpi
- CVE-2025-21619GLPI allows SQL injection through the rules configurationglpi-project glpi
- CVE-2023-22514This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for WindoAtlassian Sourcetree for Mac · Atlassian Sourcetree for Win…
- CVE-2025-27688Dell ThinOS 2408 and prior, contains an improper permissions vulnerability.Dell Wyse Proprietary OS
- CVE-2024-21760An improper control of generation of code ('Code Injection') vulnerability [CWE-94] in FortiSOAR Connector FortiSOAR 7.4 all versions, 7.3 aFortinet FortiSOAR
- CVE-2025-2449NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution VulnerabilityNI FlexLogger
- CVE-2025-2450NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution VulnerabilityNI Vision Builder AI
- CVE-2025-2494Unrestricted file upload vulnerability in Softdial Contact CenterSytel Softdial Contact Center
- CVE-2025-2493Path Traversal vulnerability in Softdial Contact CenterSytel Softdial Contact Center
- CVE-2024-23942MB connect line: Configuration File on the client workstation is not encryptedMB connect line mbCONNECT24 · MB connect line mbNET +2
- CVE-2025-1468CODESYS Control V3 - OPC UA Server Authentication bypassCODESYS Runtime Toolkit
- CVE-2025-0755MongoDB C Driver bson library may be susceptible to buffer overflowMongoDB libbson · MongoDB Server
- CVE-2025-25220Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.FUJI SOFT INCORPORATED +F FS010M
- CVE-2025-24306Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.FUJI SOFT INCORPORATED +F FS010M
- CVE-2025-2262Logo Slider <= 3.7.3 - Unauthenticated Arbitrary Shortcode Executionsamdani Logo Slider – Logo Showcase, Logo Carousel, Logo Ga…
- CVE-2024-44313TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized tastyigniter/tastyigniter
- CVE-2025-25500An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capabcosmwasm
- CVE-2025-25585Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbit
- CVE-2025-25589An XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attacker
- CVE-2025-26137Systemic Risk Value <=2.8.0 is vulnerable to Local File Inclusion via /GetFile.aspx?ReportUrl=.
- CVE-2025-30106On IROAD v9 devices, the dashcam has hardcoded default credentials ("qwertyuiop") that cannot be changed by the user.
- CVE-2025-30107On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties.
- CVE-2025-30111On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream.
- CVE-2025-30116An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820.
- CVE-2025-30117An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820.
- CVE-2025-30140An issue was discovered on G-Net Dashcam BB GONX devices.
- CVE-2025-30141An issue was discovered on G-Net Dashcam BB GONX devices.
- CVE-2025-30142An issue was discovered on G-Net Dashcam BB GONX devices.
Medium, low and unrated 25
- CVE-2025-27080Authenticated Sensitive Information Disclosure exposes Credentials in AOS-CX Command Line InterfaceHewlett Packard Enterprise (HPE) AOS-CX
- CVE-2025-25042Authenticated Access Control Vulnerability allows Sensitive Information Disclosure in AOS-CX REST InterfaceHewlett Packard Enterprise (HPE) AOS-CX
- CVE-2025-25040Failure to Properly Enforce Port ACLs on CPU generated packets in CX 9300 SwitchesHewlett Packard Enterprise (HPE) AOS-CX
- CVE-2025-29930imFAQ allows local file inclusion in seo.phpImpressModules imfaq
- CVE-2025-29790Contao allows cross-site scripting through SVG uploadscontao · contao/core-bundle
- CVE-2025-2487389-ds-base: null pointer dereference leads to denial of service389-ds-base · Red Hat Directory Server 12.4 EUS for RHEL +2
- CVE-2025-2491Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scriptingDromara ujcms
- CVE-2024-49822IBM QRadar Advisor server-side request forgeryIBM QRadar Advisor with Watson
- CVE-2025-2490Dromara ujcms File Upload WebFileUploadController.java upload cross site scriptingDromara ujcms
- CVE-2025-2495Stored Cross-Site Scripting (XSS) vulnerability in Softdial Contact CenterSytel Softdial Contact Center
- CVE-2025-2489Insecure storage of sensitive information in NTFS ToolNtfs tool
- CVE-2024-41975CODESYS (Edge) Gateway for Windows insecure defaultCODESYS Edge Gateway · CODESYS Gateway for Windows
- CVE-2025-0694CODESYS Control V3 removable media path traversalCODESYS Control for BeagleBone SL · CODESYS Control for… +13
- CVE-2025-2473PHPGurukul Company Visitor Management System Sign In index.php sql injectionPHPGurukul Company Visitor Management System
- CVE-2024-44314TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to updatetastyigniter/tastyigniter
- CVE-2024-57151SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote attacker to execute arbitrary code via the inputAction.php
- CVE-2024-57170SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php.
- CVE-2025-25580yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xml/UserMapper.xml.
- CVE-2025-25582yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /xml/OaNoticeMapper.x
- CVE-2025-25586yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml.
- CVE-2025-25590yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressDao.xml.
- CVE-2025-26138Systemic Risk Value <=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=.
- CVE-2025-30109In the IROAD APK 5.2.5, there are Hardcoded Credentials in the APK for ports 9091 and 9092.
- CVE-2025-30110On IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing.
- CVE-2025-30138An issue was discovered on G-Net Dashcam BB GONX devices.