CVEs published March 22, 2025
38 CVEs were published on March 22, 2025: 5 critical, 5 high.
- Published
- 38
- Critical
- 5
- High
- 5
- Medium
- 27
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- D-Link DAP-1620
- 4
- webtoffee Export and Import Users and Customers
- 4
- metagauss ProfileGrid – User Profiles, Groups and Communiti…
- 3
- westboy CicadasCMS
- 3
- ashikcse CITS Support svg, webp Media and TTF,OTF File Uplo…
- 2
- PHPGurukul Art Gallery Management System
- 2
- yangyouwang 杨有旺 crud 简约后台管理系统
- 2
- aizuda snail-job · com.aizuda:snail-job
- 1
- allhart Code Clone
- 1
- amans2k FunnelKit Automations – Email Marketing Automation…
- 1
Critical 5
- CVE-2025-2621D-Link DAP-1620 storage check_dws_cookie stack-based overflowD-Link DAP-1620
- CVE-2025-2620D-Link DAP-1620 Authentication storage mod_graph_auth_uri_handler stack-based overflowD-Link DAP-1620
- CVE-2025-2619D-Link DAP-1620 Cookie storage check_dws_cookie stack-based overflowD-Link DAP-1620
- CVE-2025-2618D-Link DAP-1620 Path api set_ws_action heap-based overflowD-Link DAP-1620
- CVE-2025-30472Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_eCorosync
High 5
- CVE-2025-2186Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.1 - Unauthenticated SQL Injection via 'automationId'amans2k FunnelKit Automations – Email Marketing Automation…
- CVE-2025-1970Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Functionwebtoffee Export and Import Users and Customers
- CVE-2025-1971Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameterwebtoffee Export and Import Users and Customers
- CVE-2025-2303Block Logic <= 1.0.8 - Authenticated (Contributor+) Remote Code Executionlandwire Block Logic – Full Block Display Control
- CVE-2025-0724ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injectionmetagauss ProfileGrid – User Profiles, Groups and Communiti…
Medium, low and unrated 28
- CVE-2025-2628PHPGurukul Art Gallery Management System art-enquiry.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-2627PHPGurukul Art Gallery Management System contactus.php sql injectionPHPGurukul Art Gallery Management System
- CVE-2025-2626SourceCodester Kortex Lite Advocate Office Management System edit_case.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2025-2625westboy CicadasCMS page sql injectionwestboy CicadasCMS
- CVE-2025-2624westboy CicadasCMS save sql injectionwestboy CicadasCMS
- CVE-2025-2623westboy CicadasCMS save cross site scriptingwestboy CicadasCMS
- CVE-2025-2622aizuda snail-job Workflow-Task Management Module check-node-expression getRuntime deserializationaizuda snail-job · com.aizuda:snail-job
- CVE-2025-2617yangyouwang 杨有旺 crud 简约后台管理系统 Department Page cross site scriptingyangyouwang 杨有旺 crud 简约后台管理系统
- CVE-2025-26796Apache Oozie: XSS in Oozie Web ConsoleApache Software Foundation Apache Oozie · org.apache.oozie:…
- CVE-2025-1973Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Functionwebtoffee Export and Import Users and Customers
- CVE-2025-2331GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposurestellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2025-1972Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Functionwebtoffee Export and Import Users and Customers
- CVE-2025-2577Bitspecter Suite <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadBitspecter Suite
- CVE-2025-2616yangyouwang 杨有旺 crud 简约后台管理系统 Role Management Page cross site scriptingyangyouwang 杨有旺 crud 简约后台管理系统
- CVE-2024-13666Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofingtechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2024-13768CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts <= 4.2 - Cross-Site Request Forgery to Font Assignment Deletionashikcse CITS Support svg, webp Media and TTF,OTF File Uplo…
- CVE-2025-2478Code Clone <= 0.9 - Authenticated (Administrator+) SQL Injection via snippetId Parameterallhart Code Clone
- CVE-2024-13856Make Builder <= 1.1.10 - Authenticated (Subscriber+) Server-Side Request Forgery via make_builder_ajax_subscribe Functionthethemefoundry Your Friendly Drag and Drop Page Builder —…
- CVE-2025-1311WooCommerce Multivendor Marketplace – REST API <= 1.6.2 - Authenticated (Subscriber+) SQL Injectionwclovers WCFM – Multivendor Marketplace REST API for WooCom…
- CVE-2025-2482Gotcha | Gesture-based Captcha <= 1.0.0 - Reflected Cross-Site Scripting via menu Parameterpienaro Gotcha | Gesture-based Captcha
- CVE-2025-2484Multi Video Box <= 1.5.2 - Reflected Cross-Site Scripting via video_id and group_id Parametersskustes Multi Video Box
- CVE-2025-0807CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts <= 4.2 - Cross-Site Request Forgery to Settings Updateashikcse CITS Support svg, webp Media and TTF,OTF File Uplo…
- CVE-2025-2477CryoKey <= 2.4 - Reflected Cross-Site Scripting via 'ckemail' ParameterCryoKey
- CVE-2025-2479Easy Custom Admin Bar <= 1.0 - Reflected Cross-Site Scripting via msg Parameterduogeek Easy Custom Admin Bar
- CVE-2025-1408ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Managementmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2024-13739Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parametercontrid Newsletters
- CVE-2025-0723ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injectionmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2024-13737Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creationstylemix Motors – Car Dealership & Classified Listings Plug…