# CVEs published 2025-03-18

71 CVEs were published on March 18, 2025: 15 critical, 31 high. Days are UTC.

- [CVE-2024-12563](https://cve.now/CVE-2024-12563.md): s2Member Pro \<= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode (CVSS 8.8, WP Sharks s2Member Pro)
- [CVE-2025-27080](https://cve.now/CVE-2025-27080.md): Authenticated Sensitive Information Disclosure exposes Credentials in AOS-CX Command Line Interface (CVSS 6.0, Hewlett Packard Enterprise (HPE) AOS-CX)
- [CVE-2025-25042](https://cve.now/CVE-2025-25042.md): Authenticated Access Control Vulnerability allows Sensitive Information Disclosure in AOS-CX REST Interface (CVSS 4.3, Hewlett Packard Enterprise (HPE) AOS-CX)
- [CVE-2025-25040](https://cve.now/CVE-2025-25040.md): Failure to Properly Enforce Port ACLs on CPU generated packets in CX 9300 Switches (CVSS 3.3, Hewlett Packard Enterprise (HPE) AOS-CX)
- [CVE-2025-29930](https://cve.now/CVE-2025-29930.md): imFAQ allows local file inclusion in seo.php (CVSS 6.9, ImpressModules imfaq)
- [CVE-2025-29907](https://cve.now/CVE-2025-29907.md): jsPDF Bypass Regular Expression Denial of Service (ReDoS) (CVSS 8.7, parallax jsPDF · jspdf)
- [CVE-2025-29790](https://cve.now/CVE-2025-29790.md): Contao allows cross-site scripting through SVG uploads (CVSS 4.8, contao · contao/core-bundle)
- [CVE-2025-24801](https://cve.now/CVE-2025-24801.md): GLPI allows authenticated remote code execution (CVSS 8.6, glpi-project glpi)
- [CVE-2025-24799](https://cve.now/CVE-2025-24799.md): GLPI allows unauthenticated SQL injection through the inventory endpoint (CVSS 7.5, glpi-project glpi)
- [CVE-2025-21619](https://cve.now/CVE-2025-21619.md): GLPI allows SQL injection through the rules configuration (CVSS 8.2, glpi-project glpi)
- [CVE-2023-22514](https://cve.now/CVE-2023-22514.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windo (CVSS 7.8, Atlassian Sourcetree for Mac · Atlassian Sourcetree for Win…)
- [CVE-2025-2487](https://cve.now/CVE-2025-2487.md): 389-ds-base: null pointer dereference leads to denial of service (CVSS 4.9, 389-ds-base · Red Hat Directory Server 12.4 EUS for RHEL +2)
- [CVE-2024-56347](https://cve.now/CVE-2024-56347.md): IBM AIX command execution (CVSS 9.6, IBM AIX)
- [CVE-2024-56346](https://cve.now/CVE-2024-56346.md): IBM AIX command execution (CVSS 10.0, IBM AIX)
- [CVE-2025-27688](https://cve.now/CVE-2025-27688.md): Dell ThinOS 2408 and prior, contains an improper permissions vulnerability. (CVSS 7.8, Dell Wyse Proprietary OS)
- [CVE-2025-2491](https://cve.now/CVE-2025-2491.md): Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting (CVSS 4.8, Dromara ujcms)
- [CVE-2024-49822](https://cve.now/CVE-2024-49822.md): IBM QRadar Advisor server-side request forgery (CVSS 4.1, IBM QRadar Advisor with Watson)
- [CVE-2025-2490](https://cve.now/CVE-2025-2490.md): Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting (CVSS 4.8, Dromara ujcms)
- [CVE-2023-47539](https://cve.now/CVE-2023-47539.md): An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote\_wildcard enabled may al (CVSS 9.0, Fortinet FortiMail)
- [CVE-2024-21760](https://cve.now/CVE-2024-21760.md): An improper control of generation of code ('Code Injection') vulnerability \[CWE-94\] in FortiSOAR Connector FortiSOAR 7.4 all versions, 7.3 a (CVSS 7.7, Fortinet FortiSOAR)
- [CVE-2024-8997](https://cve.now/CVE-2024-8997.md): SQLi in Vestel's EVC04 Configuration Interface (CVSS 9.8, Vestel EVC04 Configuration Interface)
- [CVE-2025-2449](https://cve.now/CVE-2025-2449.md): NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability (CVSS 7.8, NI FlexLogger)
- [CVE-2025-2450](https://cve.now/CVE-2025-2450.md): NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability (CVSS 7.8, NI Vision Builder AI)
- [CVE-2025-2495](https://cve.now/CVE-2025-2495.md): Stored Cross-Site Scripting (XSS) vulnerability in Softdial Contact Center (CVSS 5.3, Sytel Softdial Contact Center)
- [CVE-2025-2494](https://cve.now/CVE-2025-2494.md): Unrestricted file upload vulnerability in Softdial Contact Center (CVSS 8.7, Sytel Softdial Contact Center)
- [CVE-2025-2489](https://cve.now/CVE-2025-2489.md): Insecure storage of sensitive information in NTFS Tool (CVSS 6.8, Ntfs tool)
- [CVE-2025-2493](https://cve.now/CVE-2025-2493.md): Path Traversal vulnerability in Softdial Contact Center (CVSS 8.7, Sytel Softdial Contact Center)
- [CVE-2024-41975](https://cve.now/CVE-2024-41975.md): CODESYS (Edge) Gateway for Windows insecure default (CVSS 5.3, CODESYS Edge Gateway · CODESYS Gateway for Windows)
- [CVE-2025-0694](https://cve.now/CVE-2025-0694.md): CODESYS Control V3 removable media path traversal (CVSS 6.6, CODESYS Control for BeagleBone SL · CODESYS Control for… +13)
- [CVE-2024-23943](https://cve.now/CVE-2024-23943.md): MB connect line: Cloud API access due to a lack of authentication for a critical function (CVSS 9.1, MB connect line mbCONNECT24 · MB connect line mbNET +2)
- [CVE-2024-23942](https://cve.now/CVE-2024-23942.md): MB connect line: Configuration File on the client workstation is not encrypted (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mbNET +2)
- [CVE-2025-1468](https://cve.now/CVE-2025-1468.md): CODESYS Control V3 - OPC UA Server Authentication bypass (CVSS 7.5, CODESYS Runtime Toolkit)
- [CVE-2025-0755](https://cve.now/CVE-2025-0755.md): MongoDB C Driver bson library may be susceptible to buffer overflow (CVSS 8.4, MongoDB libbson · MongoDB Server)
- [CVE-2025-25220](https://cve.now/CVE-2025-25220.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0. (CVSS 8.8, FUJI SOFT INCORPORATED +F FS010M)
- [CVE-2025-24306](https://cve.now/CVE-2025-24306.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0. (CVSS 7.2, FUJI SOFT INCORPORATED +F FS010M)
- [CVE-2025-2262](https://cve.now/CVE-2025-2262.md): Logo Slider \<= 3.7.3 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, samdani Logo Slider – Logo Showcase, Logo Carousel, Logo Ga…)
- [CVE-2025-2473](https://cve.now/CVE-2025-2473.md): PHPGurukul Company Visitor Management System Sign In index.php sql injection (CVSS 6.9, PHPGurukul Company Visitor Management System)
- [CVE-2024-44313](https://cve.now/CVE-2024-44313.md): TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized (CVSS 8.1, tastyigniter/tastyigniter)
- [CVE-2024-44314](https://cve.now/CVE-2024-44314.md): TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update (CVSS 6.5, tastyigniter/tastyigniter)
- [CVE-2024-57151](https://cve.now/CVE-2024-57151.md): SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote attacker to execute arbitrary code via the inputAction.php (CVSS 6.8)
- [CVE-2024-57169](https://cve.now/CVE-2024-57169.md): A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php. (CVSS 9.8)
- [CVE-2024-57170](https://cve.now/CVE-2024-57170.md): SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. (CVSS 6.5)
- [CVE-2025-25500](https://cve.now/CVE-2025-25500.md): An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capab (CVSS 7.5, cosmwasm)
- [CVE-2025-25580](https://cve.now/CVE-2025-25580.md): yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xml/UserMapper.xml. (CVSS 6.1)
- [CVE-2025-25582](https://cve.now/CVE-2025-25582.md): yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /xml/OaNoticeMapper.x (CVSS 6.1)
- [CVE-2025-25585](https://cve.now/CVE-2025-25585.md): Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbit (CVSS 7.3)
- [CVE-2025-25586](https://cve.now/CVE-2025-25586.md): yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml. (CVSS 4.2)
- [CVE-2025-25589](https://cve.now/CVE-2025-25589.md): An XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attacker (CVSS 8.1)
- [CVE-2025-25590](https://cve.now/CVE-2025-25590.md): yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressDao.xml. (CVSS 6.1)
- [CVE-2025-25595](https://cve.now/CVE-2025-25595.md): A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack. (CVSS 9.8)
- [CVE-2025-26137](https://cve.now/CVE-2025-26137.md): Systemic Risk Value \<=2.8.0 is vulnerable to Local File Inclusion via /GetFile.aspx?ReportUrl=. (CVSS 7.5)
- [CVE-2025-26138](https://cve.now/CVE-2025-26138.md): Systemic Risk Value \<=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. (CVSS 6.5)
- [CVE-2025-30106](https://cve.now/CVE-2025-30106.md): On IROAD v9 devices, the dashcam has hardcoded default credentials ("qwertyuiop") that cannot be changed by the user. (CVSS 8.8)
- [CVE-2025-30107](https://cve.now/CVE-2025-30107.md): On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. (CVSS 7.5)
- [CVE-2025-30109](https://cve.now/CVE-2025-30109.md): In the IROAD APK 5.2.5, there are Hardcoded Credentials in the APK for ports 9091 and 9092. (CVSS 6.5)
- [CVE-2025-30110](https://cve.now/CVE-2025-30110.md): On IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing. (CVSS 6.5)
- [CVE-2025-30111](https://cve.now/CVE-2025-30111.md): On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream. (CVSS 7.5)
- [CVE-2025-30113](https://cve.now/CVE-2025-30113.md): An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. (CVSS 9.8)
- [CVE-2025-30114](https://cve.now/CVE-2025-30114.md): An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. (CVSS 9.1)
- [CVE-2025-30115](https://cve.now/CVE-2025-30115.md): An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. (CVSS 9.8)
- [CVE-2025-30116](https://cve.now/CVE-2025-30116.md): An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. (CVSS 7.5)
- [CVE-2025-30117](https://cve.now/CVE-2025-30117.md): An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. (CVSS 7.3)
- [CVE-2025-30122](https://cve.now/CVE-2025-30122.md): An issue was discovered on ROADCAM X3 devices. (CVSS 9.8)
- [CVE-2025-30123](https://cve.now/CVE-2025-30123.md): An issue was discovered on ROADCAM X3 devices. (CVSS 9.8)
- [CVE-2025-30132](https://cve.now/CVE-2025-30132.md): An issue was discovered on IROAD Dashcam V devices. (CVSS 9.1)
- [CVE-2025-30137](https://cve.now/CVE-2025-30137.md): An issue was discovered in the G-Net GNET APK 2.6.2. (CVSS 9.8)
- [CVE-2025-30138](https://cve.now/CVE-2025-30138.md): An issue was discovered on G-Net Dashcam BB GONX devices. (CVSS 4.6)
- [CVE-2025-30139](https://cve.now/CVE-2025-30139.md): An issue was discovered on G-Net Dashcam BB GONX devices. (CVSS 9.8)
- [CVE-2025-30140](https://cve.now/CVE-2025-30140.md): An issue was discovered on G-Net Dashcam BB GONX devices. (CVSS 7.5)
- [CVE-2025-30141](https://cve.now/CVE-2025-30141.md): An issue was discovered on G-Net Dashcam BB GONX devices. (CVSS 7.5)
- [CVE-2025-30142](https://cve.now/CVE-2025-30142.md): An issue was discovered on G-Net Dashcam BB GONX devices. (CVSS 8.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.