# CVEs published 2025-03-21

66 CVEs were published on March 21, 2025: 3 critical, 16 high. Days are UTC.

- [CVE-2025-2609](https://cve.now/CVE-2025-2609.md): MagnusBilling Stored Cross-Site Scripting in Login Logs (CVSS 8.2, MagnusSolution MagnusBilling)
- [CVE-2025-2610](https://cve.now/CVE-2025-2610.md): MagnusBilling Stored Cross-Site Scripting in Alarm Module (CVSS 7.6, MagnusSolution MagnusBilling)
- [CVE-2025-26500](https://cve.now/CVE-2025-26500.md): VxWorks 7 USB Failure (CVSS 4.6, Wind River Systems VxWorks)
- [CVE-2025-30204](https://cve.now/CVE-2025-30204.md): jwt-go allows excessive memory allocation during header parsing (CVSS 7.5, golang-jwt jwt · github.com/golang-jwt/jwt +2)
- [CVE-2025-2608](https://cve.now/CVE-2025-2608.md): PHPGurukul Banquet Booking System view-user-queries.php sql injection (CVSS 5.3, PHPGurukul Banquet Booking System)
- [CVE-2025-2607](https://cve.now/CVE-2025-2607.md): phplaozhang LzCMS-LaoZhangBoKeXiTong HTTP POST Request upimage.html unrestricted upload (CVSS 5.3, phplaozhang LzCMS-LaoZhangBoKeXiTong)
- [CVE-2025-2606](https://cve.now/CVE-2025-2606.md): SourceCodester Best Church Management Software soulwinning\_crud.php unrestricted upload (CVSS 5.3, SourceCodester Best Church Management Software)
- [CVE-2025-2604](https://cve.now/CVE-2025-2604.md): SourceCodester Kortex Lite Advocate Office Management System edit\_act.php sql injection (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2025-2603](https://cve.now/CVE-2025-2603.md): SourceCodester Kortex Lite Advocate Office Management System deactivate.php sql injection (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2025-2602](https://cve.now/CVE-2025-2602.md): SourceCodester Kortex Lite Advocate Office Management System deactivate\_reg.php sql injection (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2025-2601](https://cve.now/CVE-2025-2601.md): SourceCodester Kortex Lite Advocate Office Management System activate\_reg.php sql injection (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2025-25036](https://cve.now/CVE-2025-25036.md): Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE) (CVSS 6.8, Jalios JPlatform)
- [CVE-2025-25035](https://cve.now/CVE-2025-25035.md): Jalios JPlatform 10 Multiple Cross-Site Scripting (XSS) (CVSS 7.3, Jalios JPlatform)
- [CVE-2019-16151](https://cve.now/CVE-2019-16151.md): An improper neutralization of input during web page generation vulnerability \[CWE-79\] in FortiOS 6.4.1 and below, 6.2.9 and below may allow (CVSS 4.7, Fortinet FortiOS)
- [CVE-2023-43029](https://cve.now/CVE-2023-43029.md): IBM Storage Virtualize vSphere Remote Plug-in information disclosure (CVSS 6.8, IBM Storage Virtualize vSphere Remote Plug-in)
- [CVE-2025-30168](https://cve.now/CVE-2025-30168.md): Parse Server has an OAuth login vulnerability (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2021-25635](https://cve.now/CVE-2021-25635.md): Content Manipulation with Certificate Validation Attack (CVSS 5.2, The Document Foundation LibreOffice)
- [CVE-2025-30157](https://cve.now/CVE-2025-30157.md): Envoy crashes when HTTP ext\_proc processes local replies (CVSS 6.5, envoyproxy envoy · github.com/envoyproxy/envoy)
- [CVE-2025-29927](https://cve.now/CVE-2025-29927.md): Authorization Bypass in Next.js Middleware (CVSS 9.1, vercel next.js · next)
- [CVE-2025-2593](https://cve.now/CVE-2025-2593.md): FastCMS list sql injection (CVSS 5.3, FastCMS)
- [CVE-2025-27612](https://cve.now/CVE-2025-27612.md): Libcontainer is affected by capabilities elevation (CVSS 5.9, youki-dev youki · libcontainer)
- [CVE-2025-2598](https://cve.now/CVE-2025-2598.md): AWS CDK CLI prints AWS credentials retrieved by custom credential plugins (CVSS 5.7, AWS Cloud Development Kit Command Line Interface · aws-c… +1)
- [CVE-2025-24915](https://cve.now/CVE-2025-24915.md): When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permi (CVSS 7.8, Tenable Nessus Agent)
- [CVE-2025-2592](https://cve.now/CVE-2025-2592.md): Open Asset Import Library Assimp CSMLoader.cpp InternReadFile heap-based overflow (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-2591](https://cve.now/CVE-2025-2591.md): Open Asset Import Library Assimp MDLLoader.cpp InternReadFile\_Quake1 divide by zero (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-2590](https://cve.now/CVE-2025-2590.md): code-projects Human Resource Management System recruitment.go UpdateRecruitmentById cross site scripting (CVSS 4.8, code-projects Human Resource Management System)
- [CVE-2025-2589](https://cve.now/CVE-2025-2589.md): code-projects Human Resource Management System Account.go Index improper authorization (CVSS 5.1, code-projects Human Resource Management System)
- [CVE-2025-2588](https://cve.now/CVE-2025-2588.md): Hercules Augeas fa.c re\_case\_expand null pointer dereference (CVSS 4.8, Hercules Augeas)
- [CVE-2025-2587](https://cve.now/CVE-2025-2587.md): Jinher OA C6 IncentivePlanFulfillAppprove.aspx sql injection (CVSS 5.3, Jinher OA C6)
- [CVE-2025-2597](https://cve.now/CVE-2025-2597.md): Reflected Cross-Site Scripting (XSS) vulnerability in ITIUM 6050 (CVSS 5.1, Impact Technologies ITIUM)
- [CVE-2025-25068](https://cve.now/CVE-2025-25068.md): Bypassing MFA Enforcement on Plugin Endpoints (CVSS 7.5, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-24920](https://cve.now/CVE-2025-24920.md): Unauthorized Bookmark Creation and Modification in Archived Channels (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-30179](https://cve.now/CVE-2025-30179.md): MFA Enforcement Bypass in Search APIs (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-25274](https://cve.now/CVE-2025-25274.md): Unauthorized Command Execution in Archived Channels (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-27933](https://cve.now/CVE-2025-27933.md): Unauthorized Private-to-Public Channel Conversion (CVSS 5.4, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-27715](https://cve.now/CVE-2025-27715.md): Auto-Enrollment of Team Admins into Private Channels without explicit consent (CVSS 3.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-2584](https://cve.now/CVE-2025-2584.md): WebAssembly wabt binary-reader-interp.cc GetReturnCallDropKeepCount heap-based overflow (CVSS 2.3, WebAssembly wabt · wabt-bin)
- [CVE-2024-13903](https://cve.now/CVE-2024-13903.md): quickjs-ng QuickJS qjs quickjs.c JS\_GetRuntime stack-based overflow (CVSS 5.3, quickjs-ng QuickJS)
- [CVE-2025-2583](https://cve.now/CVE-2025-2583.md): SimpleMachines SMF ManageNews.php cross site scripting (CVSS 5.1, SimpleMachines SMF)
- [CVE-2025-2582](https://cve.now/CVE-2025-2582.md): SimpleMachines SMF ManageAttachments.php cross site scripting (CVSS 5.1, SimpleMachines SMF)
- [CVE-2024-50053](https://cve.now/CVE-2024-50053.md): Stored XSS (CVSS 6.3, ManageEngine ServiceDesk Plus · ManageEngine SupportCentre…)
- [CVE-2025-2581](https://cve.now/CVE-2025-2581.md): xmedcon DICOM File malloc integer underflow (CVSS 5.3, xmedcon)
- [CVE-2025-26336](https://cve.now/CVE-2025-26336.md): Dell Chassis Management Controller Firmware for Dell PowerEdge FX2, version(s) prior to 2.40.200.202101130302, and Dell Chassis Management C (CVSS 8.3, Dell Chassis Management Controller (CMC) for Dell PowerEdge…)
- [CVE-2025-2585](https://cve.now/CVE-2025-2585.md): EBM Technologies EBM Maintenance Center - SQL injection (CVSS 8.8, EBM Technologies EBM Maintenance Center)
- [CVE-2025-29814](https://cve.now/CVE-2025-29814.md): Microsoft Partner Center Elevation of Privilege Vulnerability (CVSS 9.3, Microsoft Partner Center)
- [CVE-2025-29807](https://cve.now/CVE-2025-29807.md): Microsoft Dataverse Remote Code Execution Vulnerability (CVSS 8.7, Microsoft Dataverse)
- [CVE-2023-28207](https://cve.now/CVE-2023-28207.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-53348](https://cve.now/CVE-2024-53348.md): LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate priv (CVSS 7.4, github.com/loxilb-io/loxilb)
- [CVE-2024-53349](https://cve.now/CVE-2024-53349.md): Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges (CVSS 7.4)
- [CVE-2024-53350](https://cve.now/CVE-2024-53350.md): Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges. (CVSS 7.4)
- [CVE-2024-53351](https://cve.now/CVE-2024-53351.md): Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges. (CVSS 9.8, github.com/pipe-cd/pipecd)
- [CVE-2024-57490](https://cve.now/CVE-2024-57490.md): Guangzhou Hongfan Technology Co., LTD. (CVSS 7.7)
- [CVE-2025-29223](https://cve.now/CVE-2025-29223.md): Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the pt parameter in the traceRoute function. (CVSS 6.3)
- [CVE-2025-29226](https://cve.now/CVE-2025-29226.md): In Linksys E5600 V1.1.0.26, the \\usr\\share\\lua\\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function (CVSS 6.3)
- [CVE-2025-29227](https://cve.now/CVE-2025-29227.md): In Linksys E5600 V1.1.0.26, the \\usr\\share\\lua\\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function (CVSS 6.3)
- [CVE-2025-29230](https://cve.now/CVE-2025-29230.md): Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. (CVSS 8.6)
- [CVE-2025-29640](https://cve.now/CVE-2025-29640.md): Phpgurukul Human Metapneumovirus (HMPV) – Testing Management System v1.0 is vulnerable to SQL Injection in /patient-report.php via the param (CVSS 5.4)
- [CVE-2025-29641](https://cve.now/CVE-2025-29641.md): Phpgurukul Vehicle Record Management System v1.0 is vulnerable to SQL Injection in /index.php via the 'searchinputdata' parameter. (CVSS 7.3)
- [CVE-2025-30342](https://cve.now/CVE-2025-30342.md): An XSS issue was discovered in OpenSlides before 4.2.5. (CVSS 5.4, Intevation OpenSlides)
- [CVE-2025-30343](https://cve.now/CVE-2025-30343.md): A directory traversal issue was discovered in OpenSlides before 4.2.5. (CVSS 3.0, Intevation OpenSlides)
- [CVE-2025-30344](https://cve.now/CVE-2025-30344.md): An issue was discovered in OpenSlides before 4.2.5. (CVSS 5.3, Intevation OpenSlides)
- [CVE-2025-30345](https://cve.now/CVE-2025-30345.md): An issue was discovered in OpenSlides before 4.2.5. (CVSS 3.5, Intevation OpenSlides)
- [CVE-2025-30346](https://cve.now/CVE-2025-30346.md): Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests. (CVSS 5.4, varnish-software Varnish Cache)
- [CVE-2025-30347](https://cve.now/CVE-2025-30347.md): Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on (CVSS 4.0, varnish-software Varnish Enterprise)
- [CVE-2025-30348](https://cve.now/CVE-2025-30348.md): encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with re (CVSS 5.8, Qt)
- [CVE-2025-30349](https://cve.now/CVE-2025-30349.md): Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted t (CVSS 7.2, Horde IMP)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.