CVEs published March 21, 2025
66 CVEs were published on March 21, 2025: 3 critical, 16 high.
- Published
- 66
- Critical
- 3
- High
- 16
- Medium
- 43
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- Intevation OpenSlides
- 4
- SourceCodester Kortex Lite Advocate Office Management System
- 4
- Mattermost · github.com/mattermost/mattermost-server +3
- 3
- Mattermost · github.com/mattermost/mattermost/server/v8 +3
- 3
- code-projects Human Resource Management System
- 2
- Jalios JPlatform
- 2
- MagnusSolution MagnusBilling
- 2
- Open Asset Import Library Assimp · pyassimp
- 2
- SimpleMachines SMF
- 2
- Apple macOS
- 1
Critical 3
- CVE-2025-29927Authorization Bypass in Next.js Middlewarevercel next.js · next
- CVE-2025-29814Microsoft Partner Center Elevation of Privilege VulnerabilityMicrosoft Partner Center
- CVE-2024-53351Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.github.com/pipe-cd/pipecd
High 16
- CVE-2025-2609MagnusBilling Stored Cross-Site Scripting in Login LogsMagnusSolution MagnusBilling
- CVE-2025-2610MagnusBilling Stored Cross-Site Scripting in Alarm ModuleMagnusSolution MagnusBilling
- CVE-2025-30204jwt-go allows excessive memory allocation during header parsinggolang-jwt jwt · github.com/golang-jwt/jwt +2
- CVE-2025-25035Jalios JPlatform 10 Multiple Cross-Site Scripting (XSS)Jalios JPlatform
- CVE-2025-24915When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permiTenable Nessus Agent
- CVE-2025-25068Bypassing MFA Enforcement on Plugin EndpointsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2025-26336Dell Chassis Management Controller Firmware for Dell PowerEdge FX2, version(s) prior to 2.40.200.202101130302, and Dell Chassis Management CDell Chassis Management Controller (CMC) for Dell PowerEdge…
- CVE-2025-2585EBM Technologies EBM Maintenance Center - SQL injectionEBM Technologies EBM Maintenance Center
- CVE-2025-29807Microsoft Dataverse Remote Code Execution VulnerabilityMicrosoft Dataverse
- CVE-2024-53348LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privgithub.com/loxilb-io/loxilb
- CVE-2024-53349Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges
- CVE-2024-53350Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges.
- CVE-2024-57490Guangzhou Hongfan Technology Co., LTD.
- CVE-2025-29230Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function.
- CVE-2025-29641Phpgurukul Vehicle Record Management System v1.0 is vulnerable to SQL Injection in /index.php via the 'searchinputdata' parameter.
- CVE-2025-30349Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted tHorde IMP
Medium, low and unrated 47
- CVE-2025-26500VxWorks 7 USB FailureWind River Systems VxWorks
- CVE-2025-2608PHPGurukul Banquet Booking System view-user-queries.php sql injectionPHPGurukul Banquet Booking System
- CVE-2025-2607phplaozhang LzCMS-LaoZhangBoKeXiTong HTTP POST Request upimage.html unrestricted uploadphplaozhang LzCMS-LaoZhangBoKeXiTong
- CVE-2025-2606SourceCodester Best Church Management Software soulwinning_crud.php unrestricted uploadSourceCodester Best Church Management Software
- CVE-2025-2604SourceCodester Kortex Lite Advocate Office Management System edit_act.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2025-2603SourceCodester Kortex Lite Advocate Office Management System deactivate.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2025-2602SourceCodester Kortex Lite Advocate Office Management System deactivate_reg.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2025-2601SourceCodester Kortex Lite Advocate Office Management System activate_reg.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2025-25036Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE)Jalios JPlatform
- CVE-2019-16151An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow Fortinet FortiOS
- CVE-2023-43029IBM Storage Virtualize vSphere Remote Plug-in information disclosureIBM Storage Virtualize vSphere Remote Plug-in
- CVE-2025-30168Parse Server has an OAuth login vulnerabilityparse-community parse-server · parse-server
- CVE-2021-25635Content Manipulation with Certificate Validation AttackThe Document Foundation LibreOffice
- CVE-2025-30157Envoy crashes when HTTP ext_proc processes local repliesenvoyproxy envoy · github.com/envoyproxy/envoy
- CVE-2025-2593FastCMS list sql injectionFastCMS
- CVE-2025-27612Libcontainer is affected by capabilities elevationyouki-dev youki · libcontainer
- CVE-2025-2598AWS CDK CLI prints AWS credentials retrieved by custom credential pluginsAWS Cloud Development Kit Command Line Interface · aws-c… +1
- CVE-2025-2592Open Asset Import Library Assimp CSMLoader.cpp InternReadFile heap-based overflowOpen Asset Import Library Assimp · pyassimp
- CVE-2025-2591Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_Quake1 divide by zeroOpen Asset Import Library Assimp · pyassimp
- CVE-2025-2590code-projects Human Resource Management System recruitment.go UpdateRecruitmentById cross site scriptingcode-projects Human Resource Management System
- CVE-2025-2589code-projects Human Resource Management System Account.go Index improper authorizationcode-projects Human Resource Management System
- CVE-2025-2588Hercules Augeas fa.c re_case_expand null pointer dereferenceHercules Augeas
- CVE-2025-2587Jinher OA C6 IncentivePlanFulfillAppprove.aspx sql injectionJinher OA C6
- CVE-2025-2597Reflected Cross-Site Scripting (XSS) vulnerability in ITIUM 6050Impact Technologies ITIUM
- CVE-2025-24920Unauthorized Bookmark Creation and Modification in Archived ChannelsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2025-30179MFA Enforcement Bypass in Search APIsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-25274Unauthorized Command Execution in Archived ChannelsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2025-27933Unauthorized Private-to-Public Channel ConversionMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-27715Auto-Enrollment of Team Admins into Private Channels without explicit consentMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-2584WebAssembly wabt binary-reader-interp.cc GetReturnCallDropKeepCount heap-based overflowWebAssembly wabt · wabt-bin
- CVE-2024-13903quickjs-ng QuickJS qjs quickjs.c JS_GetRuntime stack-based overflowquickjs-ng QuickJS
- CVE-2025-2583SimpleMachines SMF ManageNews.php cross site scriptingSimpleMachines SMF
- CVE-2025-2582SimpleMachines SMF ManageAttachments.php cross site scriptingSimpleMachines SMF
- CVE-2024-50053Stored XSSManageEngine ServiceDesk Plus · ManageEngine SupportCentre…
- CVE-2025-2581xmedcon DICOM File malloc integer underflowxmedcon
- CVE-2023-28207The issue was addressed with improved checks.Apple macOS
- CVE-2025-29223Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the pt parameter in the traceRoute function.
- CVE-2025-29226In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function
- CVE-2025-29227In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function
- CVE-2025-29640Phpgurukul Human Metapneumovirus (HMPV) – Testing Management System v1.0 is vulnerable to SQL Injection in /patient-report.php via the param
- CVE-2025-30342An XSS issue was discovered in OpenSlides before 4.2.5.Intevation OpenSlides
- CVE-2025-30343A directory traversal issue was discovered in OpenSlides before 4.2.5.Intevation OpenSlides
- CVE-2025-30344An issue was discovered in OpenSlides before 4.2.5.Intevation OpenSlides
- CVE-2025-30345An issue was discovered in OpenSlides before 4.2.5.Intevation OpenSlides
- CVE-2025-30346Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.varnish-software Varnish Cache
- CVE-2025-30347Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on varnish-software Varnish Enterprise
- CVE-2025-30348encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with reQt