# CVEs published 2025-03-24 156 CVEs were published on March 24, 2025: 12 critical, 45 high. 3 are now in CISA KEV. Days are UTC. - [CVE-2025-2717](https://cve.now/CVE-2025-2717.md): D-Link DIR-823X HTTP POST Request diag\_nslookup sub\_41710C os command injection (CVSS 5.1, D-Link DIR-823X) - [CVE-2025-24514](https://cve.now/CVE-2025-24514.md): ingress-nginx controller - configuration injection via unsanitized auth-url annotation (CVSS 8.8, kubernetes ingress-nginx · k8s.io/ingress-nginx) - [CVE-2025-24513](https://cve.now/CVE-2025-24513.md): ingress-nginx controller - auth secret file path traversal vulnerability (CVSS 4.8, kubernetes ingress-nginx · k8s.io/ingress-nginx) - [CVE-2025-1098](https://cve.now/CVE-2025-1098.md): ingress-nginx controller - configuration injection via unsanitized mirror annotations (CVSS 8.8, kubernetes ingress-nginx · k8s.io/ingress-nginx) - [CVE-2025-1097](https://cve.now/CVE-2025-1097.md): ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation (CVSS 8.8, kubernetes ingress-nginx · k8s.io/ingress-nginx) - [CVE-2025-1974](https://cve.now/CVE-2025-1974.md): ingress-nginx admission controller RCE escalation (CVSS 9.8, kubernetes ingress-nginx · k8s.io/ingress-nginx) - [CVE-2025-2716](https://cve.now/CVE-2025-2716.md): China Mobile P22g-CIac Samba Path path traversal (CVSS 5.1, China Mobile P22g-CIac) - [CVE-2025-2715](https://cve.now/CVE-2025-2715.md): timschofield webERP Confirm Dispatch and Invoice Page ConfirmDispatch\_Invoice.php cross site scripting (CVSS 5.1, timschofield webERP) - [CVE-2025-26512](https://cve.now/CVE-2025-26512.md): CVE-2025-26512 Privilege Escalation Vulnerability in SnapCenter (CVSS 9.9, NetApp SnapCenter) - [CVE-2025-2714](https://cve.now/CVE-2025-2714.md): JoomlaUX JUX Real Estate addagent cross site scripting (CVSS 5.3, JoomlaUX JUX Real Estate) - [CVE-2025-2712](https://cve.now/CVE-2025-2712.md): Yonyou UFIDA ERP-NC top.jsp cross site scripting (CVSS 5.3, Yonyou UFIDA ERP-NC) - [CVE-2025-2711](https://cve.now/CVE-2025-2711.md): Yonyou UFIDA ERP-NC systop.jsp cross site scripting (CVSS 5.3, Yonyou UFIDA ERP-NC) - [CVE-2025-2710](https://cve.now/CVE-2025-2710.md): Yonyou UFIDA ERP-NC menu.jsp cross site scripting (CVSS 5.3, Yonyou UFIDA ERP-NC) - [CVE-2025-2709](https://cve.now/CVE-2025-2709.md): Yonyou UFIDA ERP-NC login.jsp cross site scripting (CVSS 5.3, Yonyou UFIDA ERP-NC) - [CVE-2025-2231](https://cve.now/CVE-2025-2231.md): PDF-XChange Editor RTF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, PDF-XChange Editor) - [CVE-2025-2708](https://cve.now/CVE-2025-2708.md): zhijiantianya ruoyi-vue-pro Backend File Upload upload path traversal (CVSS 5.3, zhijiantianya ruoyi-vue-pro) - [CVE-2025-2707](https://cve.now/CVE-2025-2707.md): zhijiantianya ruoyi-vue-pro Front-End Store upload path traversal (CVSS 5.3, zhijiantianya ruoyi-vue-pro) - [CVE-2025-30163](https://cve.now/CVE-2025-30163.md): Node based network policies may incorrectly allow workload traffic (CVSS 3.4, cilium · github.com/cilium/cilium) - [CVE-2025-30162](https://cve.now/CVE-2025-30162.md): East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers (CVSS 3.2, cilium · github.com/cilium/cilium) - [CVE-2025-2706](https://cve.now/CVE-2025-2706.md): Digiwin ERP UploadAjaxAPI.ashx unrestricted upload (CVSS 5.3, Digiwin ERP) - [CVE-2025-2748](https://cve.now/CVE-2025-2748.md): Kentico Xperience stored cross-site scripting in multiple-file upload functionality (CVSS 6.1, Kentico Xperience) - [CVE-2025-2749](https://cve.now/CVE-2025-2749.md): Kentico Xperience \<= 13.0.178 Staging Media File Upload Authenticated RCE (CVSS 7.2, KEV, Kentico Xperience) - [CVE-2025-2747](https://cve.now/CVE-2025-2747.md): Kentico Xperience \<= 13.0.178 Staging Sync Server None Password Type Authentication Bypass (CVSS 9.8, KEV, Kentico Xperience) - [CVE-2025-2746](https://cve.now/CVE-2025-2746.md): Kentico Xperience \<= 13.0.172 Staging Sync Server Digest Password Authentication Bypass (CVSS 9.8, KEV, Kentico Xperience) - [CVE-2025-22223](https://cve.now/CVE-2025-22223.md): Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. (CVSS 5.3, Spring Security · org.springframework.security:spring-secur…) - [CVE-2025-30208](https://cve.now/CVE-2025-30208.md): Vite bypasses server.fs.deny when using \`?raw??\` (CVSS 5.3, vitejs vite · vite) - [CVE-2025-30205](https://cve.now/CVE-2025-30205.md): kanidm-provision leaks provisioned admin credentials into the system log (CVSS 7.6, oddlama kanidm-provision) - [CVE-2025-29778](https://cve.now/CVE-2025-29778.md): Kyverno ignores subjectRegExp and IssuerRegExp (CVSS 5.8, kyverno · github.com/kyverno/kyverno) - [CVE-2025-0255](https://cve.now/CVE-2025-0255.md): HCL DevOps Deploy / HCL Launch is susceptible to command injection vulnerability (CVSS 7.2, HCL Software HCL DevOps Deploy / HCL Launch) - [CVE-2024-9103](https://cve.now/CVE-2024-9103.md): Persistent XSS in blocked messages (CVSS 6.1, Forcepoint Email Security) - [CVE-2025-2705](https://cve.now/CVE-2025-2705.md): Digiwin ERP FileUploadApi.ashx DoWebUpload unrestricted upload (CVSS 6.9, Digiwin ERP) - [CVE-2025-23204](https://cve.now/CVE-2025-23204.md): GraphQl securityAfterResolver not called (CVSS 4.4, api-platform core · api-platform/core) - [CVE-2023-25610](https://cve.now/CVE-2023-25610.md): A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, vers (CVSS 9.3, Fortinet FortiSwitchManager · Fortinet FortiAnalyzer +5) - [CVE-2021-26091](https://cve.now/CVE-2021-26091.md): A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service (CVSS 6.9, Fortinet FortiMail) - [CVE-2025-0256](https://cve.now/CVE-2025-0256.md): HCL DevOps Deploy / HCL Launch is susceptible to a sensitive information disclosure (CVSS 4.3, HCL Software HCL DevOps Deploy / HCL Launch) - [CVE-2021-26105](https://cve.now/CVE-2021-26105.md): A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of FortiSandbox version 3.2.2 and below, version 3.1.4 and below (CVSS 6.4, Fortinet FortiSandbox) - [CVE-2025-1558](https://cve.now/CVE-2025-1558.md): Denial of Service Via Malicious GIF (CVSS 6.5, Mattermost) - [CVE-2025-30623](https://cve.now/CVE-2025-30623.md): WordPress wA11y – The Web Accessibility Toolbox plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Rachel Cherry wA11y – The Web Accessibility Toolbox) - [CVE-2025-30621](https://cve.now/CVE-2025-30621.md): WordPress Translator plugin \<= 0.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, kornelly Translator) - [CVE-2025-30620](https://cve.now/CVE-2025-30620.md): WordPress WP Odoo Form Integrator plugin \<=1.1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, coderscom WP Odoo Form Integrator) - [CVE-2025-30619](https://cve.now/CVE-2025-30619.md): WordPress SpeakPipe plugin \<= 0.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, SpeakPipe) - [CVE-2025-30617](https://cve.now/CVE-2025-30617.md): WordPress Rewrite plugin \<= 0.2.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, takien Rewrite) - [CVE-2025-30615](https://cve.now/CVE-2025-30615.md): WordPress WP e-Commerce Style Email plugin \<= 0.6.2 - CSRF to Remote Code Execution vulnerability (CVSS 9.6, Jacob Schwartz WP e-Commerce Style Email) - [CVE-2025-30612](https://cve.now/CVE-2025-30612.md): WordPress Replace Default Words plugin \<= 1.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, mandegarweb Replace Default Words) - [CVE-2025-30610](https://cve.now/CVE-2025-30610.md): WordPress WP Social Widget plugin \<= 2.2.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, catchsquare WP Social Widget) - [CVE-2025-30609](https://cve.now/CVE-2025-30609.md): WordPress AppExperts plugin \<= 1.4.3 - Sensitive Data Exposure Vulnerability (CVSS 5.3, Saad Iqbal AppExperts) - [CVE-2025-30608](https://cve.now/CVE-2025-30608.md): WordPress SQL Backup plugin \<= 3.5.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Anthony WordPress SQL Backup) - [CVE-2025-30606](https://cve.now/CVE-2025-30606.md): WordPress Easy Page Transition plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Logan Carlile Easy Page Transition) - [CVE-2025-30605](https://cve.now/CVE-2025-30605.md): WordPress sourceplay-navermap plugin \<= 0.0.2 - Broken Access Control vulnerability (CVSS 4.3, ldwin79 sourceplay-navermap) - [CVE-2025-30604](https://cve.now/CVE-2025-30604.md): WordPress JiangQie Official Website Mini Program plugin \<= 1.8.2 - SQL Injection Vulnerability (CVSS 7.6, JiangQie Official Website Mini Program) - [CVE-2025-30603](https://cve.now/CVE-2025-30603.md): WordPress CopyLink plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, DEJAN CopyLink) - [CVE-2025-30602](https://cve.now/CVE-2025-30602.md): WordPress Related Posts via Categories plugin \<= 2.1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, alphasis Related Posts via Categories) - [CVE-2025-30601](https://cve.now/CVE-2025-30601.md): WordPress Flipdish Ordering System plugin \<= 1.5.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, Flipdish Ordering System) - [CVE-2025-30600](https://cve.now/CVE-2025-30600.md): WordPress WP Hotjar plugin \<= 0.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, thiagogsrwp WP Hotjar) - [CVE-2025-30599](https://cve.now/CVE-2025-30599.md): WordPress WP Parallax Content Slider plugin \<= 0.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, wp-maverick WP Parallax Content Slider) - [CVE-2025-30598](https://cve.now/CVE-2025-30598.md): WordPress OSS Upload plugin \<= 4.8.9 Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Link OSS Upload) - [CVE-2025-30597](https://cve.now/CVE-2025-30597.md): WordPress IG Shortcodes plugin \<= 3.1 Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, iografica IG Shortcodes) - [CVE-2025-30595](https://cve.now/CVE-2025-30595.md): WordPress include-file plugin \<= 1 Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, tstafford include-file) - [CVE-2025-30593](https://cve.now/CVE-2025-30593.md): WordPress Include URL plugin \<= 0.3.5 Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, samsk Include URL) - [CVE-2025-30592](https://cve.now/CVE-2025-30592.md): WordPress Advanced Dewplayer - plugin \<= 1.6 Broken Access Control Vulnerability (CVSS 5.3, WesternDeal Advanced Dewplayer) - [CVE-2025-30591](https://cve.now/CVE-2025-30591.md): WordPress Music Press Pro plugin \<= 1.4.6 Broken Access Control Vulnerability (CVSS 5.3, tuyennv Music Press Pro) - [CVE-2025-30590](https://cve.now/CVE-2025-30590.md): WordPress Flickr set slideshows plugin \<= 0.9 - SQL Injection Vulnerability (CVSS 8.5, Dourou Flickr set slideshows) - [CVE-2025-30588](https://cve.now/CVE-2025-30588.md): WordPress Map Contact plugin \<= 3.0.4 - CSRF to Stored XSS Vulnerability (CVSS 7.1, ryan\_xantoo Map Contact) - [CVE-2025-30587](https://cve.now/CVE-2025-30587.md): WordPress LH OGP Meta plugin \<= 1.73 - CSRF to Stored XSS Vulnerability (CVSS 7.1, shawfactor LH OGP Meta) - [CVE-2025-30586](https://cve.now/CVE-2025-30586.md): WordPress cTabs plugin \<= 1.3 - CSRF to Stored XSS Vulnerability (CVSS 7.1, bbodine1 cTabs) - [CVE-2025-30585](https://cve.now/CVE-2025-30585.md): WordPress Generate Post Thumbnails plugin \<= 0.8 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, marynixie Generate Post Thumbnails) - [CVE-2025-30584](https://cve.now/CVE-2025-30584.md): WordPress AlphaOmega Captcha & Anti-Spam Filter plugin \<= 3.3 - CSRF to Stored XSS Vulnerability (CVSS 7.1, alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter) - [CVE-2025-30583](https://cve.now/CVE-2025-30583.md): WordPress Pro Rank Tracker plugin \<= 1.0.0 - CSRF to Stored XSS Vulnerability (CVSS 7.1, ProRankTracker Pro Rank Tracker) - [CVE-2025-30581](https://cve.now/CVE-2025-30581.md): WordPress Top Bar plugin \<= 3.3 - Broken Access Control Vulnerability (CVSS 5.3, PluginOps Top Bar) - [CVE-2025-30578](https://cve.now/CVE-2025-30578.md): WordPress AdSense Privacy Policy plugin \<= 1.1.1 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability (CVSS 7.1, hotvanrod AdSense Privacy Policy) - [CVE-2025-30577](https://cve.now/CVE-2025-30577.md): WordPress Browser Address Bar Color plugin \<= 3.3 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability (CVSS 7.1, mendibass Browser Address Bar Color) - [CVE-2025-30576](https://cve.now/CVE-2025-30576.md): WordPress Hacklog Remote Image Autosave plugin \<= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, HuangYe WuDeng Hacklog Remote Image Autosave) - [CVE-2025-30575](https://cve.now/CVE-2025-30575.md): WordPress Login Redirect plugin \<= - 1.0.5 Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Arefly Login Redirect) - [CVE-2025-30574](https://cve.now/CVE-2025-30574.md): WordPress Mobile Navigation plugin \<= - 1.5 Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Jenst Mobile Navigation) - [CVE-2025-30573](https://cve.now/CVE-2025-30573.md): WordPress My Default Post Content plugin \<= - 0.7.3 Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, mrdenny My Default Post Content) - [CVE-2025-30572](https://cve.now/CVE-2025-30572.md): WordPress Simple Rating plugin \<= 1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, Igor Yavych Simple Rating) - [CVE-2025-30571](https://cve.now/CVE-2025-30571.md): WordPress STEdb Forms plugin \<= 1.0.4 - SQL Injection Vulnerability (CVSS 7.6, STEdb Forms) - [CVE-2025-30570](https://cve.now/CVE-2025-30570.md): WordPress دکمه، شبکه اجتماعی خرید plugin \<= 2.0.6 - SQL Injection Vulnerability (CVSS 7.6, AliRezaMohammadi دکمه، شبکه اجتماعی خرید) - [CVE-2025-30569](https://cve.now/CVE-2025-30569.md): WordPress WP Featured Entries plugin \<= - 1.0 SQL Injection Vulnerability (CVSS 8.5, Jahertor WP Featured Entries) - [CVE-2025-30568](https://cve.now/CVE-2025-30568.md): WordPress Super Static Cache plugin \<= 3.3.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, hitoy Super Static Cache) - [CVE-2025-30566](https://cve.now/CVE-2025-30566.md): WordPress Clink plugin \<= 1.2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Aryan Themes Clink) - [CVE-2025-30565](https://cve.now/CVE-2025-30565.md): WordPress banner-manager plugin \<= 16.04.19 - CSRF to Stored XSS vulnerability (CVSS 7.1, karrikas banner-manager) - [CVE-2025-30564](https://cve.now/CVE-2025-30564.md): WordPress Custom Script Integration plugin \<= - 2.1 Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, wpwox Custom Script Integration) - [CVE-2025-30561](https://cve.now/CVE-2025-30561.md): WordPress CAS Maestro plugin \<= 1.1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Henrique Mouta CAS Maestro) - [CVE-2025-30560](https://cve.now/CVE-2025-30560.md): WordPress jQuery Dropdown Menu plugin \<= 3.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Sana Ullah jQuery Dropdown Menu) - [CVE-2025-30558](https://cve.now/CVE-2025-30558.md): WordPress ANAC XML Render plugin \<= 1.5.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, EnzoCostantini55 ANAC XML Render) - [CVE-2025-30557](https://cve.now/CVE-2025-30557.md): WordPress Easy 301 Redirects plugin \<= 1.33 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, odihost Easy 301 Redirects) - [CVE-2025-30556](https://cve.now/CVE-2025-30556.md): WordPress Fix Rss Feeds plugin \<= 3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, flyaga Fix Rss Feeds) - [CVE-2025-30555](https://cve.now/CVE-2025-30555.md): WordPress WordPres 同步微博 plugin \<= 1.1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, iiiryan WordPres 同步微博) - [CVE-2025-30553](https://cve.now/CVE-2025-30553.md): WordPress GMO Font Agent plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Z.com byGMO GMO Font Agent) - [CVE-2025-30552](https://cve.now/CVE-2025-30552.md): WordPress WordPress Admin Bar Improved plugin \<= 3.3.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Donald Gilbert WordPress Admin Bar Improved) - [CVE-2025-30551](https://cve.now/CVE-2025-30551.md): WordPress Pretty file links plugin \<= 0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, smartredfox Pretty file links) - [CVE-2025-30550](https://cve.now/CVE-2025-30550.md): WordPress CallPhone'r plugin \<= 1.1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, WPShop.ru CallPhone'r) - [CVE-2025-30549](https://cve.now/CVE-2025-30549.md): WordPress Yummly Rich Recipes plugin \<= 4.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Yummly Rich Recipes) - [CVE-2025-30546](https://cve.now/CVE-2025-30546.md): WordPress Cackle plugin \<= 4.33 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, boroV Cackle) - [CVE-2025-30545](https://cve.now/CVE-2025-30545.md): WordPress issuuPress plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, pixeline issuuPress) - [CVE-2025-30543](https://cve.now/CVE-2025-30543.md): WordPress Menu Duplicator plugin \<= 1.0 - Broken Access Control vulnerability (CVSS 4.3, swayam.tejwani Menu Duplicator) - [CVE-2025-30542](https://cve.now/CVE-2025-30542.md): WordPress WP SoundCloud Ultimate plugin \<= 1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wpsolutions SoundCloud Ultimate) - [CVE-2025-30541](https://cve.now/CVE-2025-30541.md): WordPress Info Boxes Shortcode And Widgets plugin \<= 1.15 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, OTWthemes Info Boxes Shortcode and Widget) - [CVE-2025-30540](https://cve.now/CVE-2025-30540.md): WordPress AvaiBook plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, AvaiBook) - [CVE-2025-30539](https://cve.now/CVE-2025-30539.md): WordPress BMo Expo plugin \<= 1.0.15 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Benedikt Mo BMo Expo) - [CVE-2025-30538](https://cve.now/CVE-2025-30538.md): WordPress Simple Optimizer plugin \<= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ChrisHurst Simple Optimizer) - [CVE-2025-30537](https://cve.now/CVE-2025-30537.md): WordPress Upload Quota per User plugin \<= 1.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Cristian Sarov Upload Quota per User) - [CVE-2025-30536](https://cve.now/CVE-2025-30536.md): WordPress Beautiful Link Preview plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, zeitwesentech Beautiful Link Preview) - [CVE-2025-30535](https://cve.now/CVE-2025-30535.md): WordPress External image replace plugin \<= 1.0.8 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, muro External image replace) - [CVE-2025-30534](https://cve.now/CVE-2025-30534.md): WordPress Image Captcha plugin \<= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, captcha.soft Image Captcha) - [CVE-2025-30533](https://cve.now/CVE-2025-30533.md): WordPress Message ticker plugin \<= 9.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, gopiplus Message ticker) - [CVE-2025-30532](https://cve.now/CVE-2025-30532.md): WordPress Weather Layer plugin \<= 4.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, MorganF Weather Layer) - [CVE-2025-30531](https://cve.now/CVE-2025-30531.md): WordPress WP Ride Booking plugin \<= 2.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, GBS Developer WP Ride Booking) - [CVE-2025-30530](https://cve.now/CVE-2025-30530.md): WordPress AI Preloader plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Atikul AI Preloader) - [CVE-2025-30529](https://cve.now/CVE-2025-30529.md): WordPress Auto Load Next Post plugin \<= 1.5.14 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Sébastien Dumont Auto Load Next Post) - [CVE-2025-30528](https://cve.now/CVE-2025-30528.md): WordPress Awesome Logos plugin \<= 1.2 - CSRF to SQL Injection vulnerability (CVSS 9.3, wpshopee Awesome Logos) - [CVE-2025-30527](https://cve.now/CVE-2025-30527.md): WordPress My Bootstrap Menu plugin \<= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, codetoolbox My Bootstrap Menu) - [CVE-2025-30526](https://cve.now/CVE-2025-30526.md): WordPress Typekit plugin \<= 1.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, lucksy Typekit plugin for WordPress) - [CVE-2025-30525](https://cve.now/CVE-2025-30525.md): WordPress WP Profitshare plugin \<= 1.4.9 - SQL Injection vulnerability (CVSS 7.6, ProfitShare.ro WP Profitshare) - [CVE-2025-30523](https://cve.now/CVE-2025-30523.md): WordPress Super Simple Subscriptions plugin \<= 1.1.0 - SQL Injection vulnerability (CVSS 7.6, Marcel-NL Super Simple Subscriptions) - [CVE-2025-30522](https://cve.now/CVE-2025-30522.md): WordPress Contact Form 7 Material Design plugin \<= 1.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Damian Orzol Contact Form 7 Material Design) - [CVE-2025-30521](https://cve.now/CVE-2025-30521.md): WordPress GP Back To Top plugin \<= 3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, giangmd93 GP Back To Top) - [CVE-2024-8774](https://cve.now/CVE-2024-8774.md): Privilege Escalation in SIMPLE.ERP (CVSS 7.7, Simple SA SIMPLE.ERP) - [CVE-2024-8773](https://cve.now/CVE-2024-8773.md): Protocol Downgrade in SIMPLE.ERP (CVSS 8.3, Simple SA SIMPLE.ERP) - [CVE-2025-0835](https://cve.now/CVE-2025-0835.md): GPU DDK - \_WrapExtMemReleasePages called twice if \_FlushUMVirtualRange fails (CVSS 7.8, Imagination Technologies Graphics DDK) - [CVE-2025-0478](https://cve.now/CVE-2025-0478.md): GPU DDK - PMMETA\_PROTECT PMR can be exported as dma-buf file / GEM object (CVSS 7.8, Imagination Technologies Graphics DDK) - [CVE-2025-2702](https://cve.now/CVE-2025-2702.md): Softwin WMX3 ImageAdd.ashx ImageAdd unrestricted upload (CVSS 5.3, Softwin WMX3) - [CVE-2025-2701](https://cve.now/CVE-2025-2701.md): AMTT Hotel Broadband Operation System port\_setup.php popen os command injection (CVSS 5.3, AMTT Hotel Broadband Operation System) - [CVE-2025-2700](https://cve.now/CVE-2025-2700.md): michelson Dante Editor Insert Link cross site scripting (CVSS 5.1, michelson Dante Editor) - [CVE-2025-2699](https://cve.now/CVE-2025-2699.md): GetmeUK ContentTools Image cross site scripting (CVSS 5.1, GetmeUK ContentTools · ContentTools) - [CVE-2025-2690](https://cve.now/CVE-2025-2690.md): yiisoft Yii2 MockClass.php generate deserialization (CVSS 5.3, yiisoft Yii2) - [CVE-2025-2689](https://cve.now/CVE-2025-2689.md): yiisoft Yii2 SortableIterator.php getIterator deserialization (CVSS 5.3, yiisoft Yii2 · yiisoft/yii2-dev) - [CVE-2025-2688](https://cve.now/CVE-2025-2688.md): TOTOLINK A3000RU Syslog Configuration File ExportSyslog.sh access control (CVSS 5.3, TOTOLINK A3000RU) - [CVE-2025-2687](https://cve.now/CVE-2025-2687.md): PHPGurukul eLearning System Image index.php unrestricted upload (CVSS 5.3, PHPGurukul eLearning System) - [CVE-2025-1203](https://cve.now/CVE-2025-1203.md): Slider, Gallery, Carousel by MetaSlider \< 3.95.0 - Editor+ Stored XSS (CVSS 3.5, Slider, Gallery, and Carousel by MetaSlider) - [CVE-2025-1062](https://cve.now/CVE-2025-1062.md): Slider, Gallery, Carousel by MetaSlider \< 3.95.0 - Editor+ Stored XSS (CVSS 3.5, Slider, Gallery, and Carousel by MetaSlider) - [CVE-2024-13124](https://cve.now/CVE-2024-13124.md): Photo Gallery by 10Web \< 1.8.33 - Admin+ Stored XSS (CVSS 3.5, Photo Gallery by 10Web) - [CVE-2024-10558](https://cve.now/CVE-2024-10558.md): Form Maker by 10Web \< 1.15.30 - Admin+ Stored XSS (CVSS 3.5, Form Maker by 10Web) - [CVE-2025-2686](https://cve.now/CVE-2025-2686.md): mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 Backend admin doFilter access control (CVSS 6.9, mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统) - [CVE-2025-2684](https://cve.now/CVE-2025-2684.md): PHPGurukul Bank Locker Management System search-report-details.php sql injection (CVSS 6.9, PHPGurukul Bank Locker Management System) - [CVE-2025-2683](https://cve.now/CVE-2025-2683.md): PHPGurukul Bank Locker Management System profile.php sql injection (CVSS 6.9, PHPGurukul Bank Locker Management System) - [CVE-2025-2682](https://cve.now/CVE-2025-2682.md): PHPGurukul Bank Locker Management System edit-subadmin.php sql injection (CVSS 6.9, PHPGurukul Bank Locker Management System) - [CVE-2025-2681](https://cve.now/CVE-2025-2681.md): PHPGurukul Bank Locker Management System edit-locker.php sql injection (CVSS 6.9, PHPGurukul Bank Locker Management System) - [CVE-2025-2680](https://cve.now/CVE-2025-2680.md): PHPGurukul Bank Locker Management System edit-assign-locker.php sql injection (CVSS 6.9, PHPGurukul Bank Locker Management System) - [CVE-2025-2679](https://cve.now/CVE-2025-2679.md): PHPGurukul Bank Locker Management System contact-us.php sql injection (CVSS 6.9, PHPGurukul Bank Locker Management System) - [CVE-2025-2678](https://cve.now/CVE-2025-2678.md): PHPGurukul Bank Locker Management System changeimage1.php sql injection (CVSS 6.9, PHPGurukul Bank Locker Management System) - [CVE-2025-2677](https://cve.now/CVE-2025-2677.md): PHPGurukul Bank Locker Management System changeidproof.php sql injection (CVSS 6.9, PHPGurukul Bank Locker Management System) - [CVE-2025-2676](https://cve.now/CVE-2025-2676.md): PHPGurukul Bank Locker Management System add-subadmin.php sql injection (CVSS 6.9, PHPGurukul Bank Locker Management System) - [CVE-2025-2675](https://cve.now/CVE-2025-2675.md): PHPGurukul Bank Locker Management System add-lockertype.php sql injection (CVSS 6.9, PHPGurukul Bank Locker Management System) - [CVE-2025-2674](https://cve.now/CVE-2025-2674.md): PHPGurukul Bank Locker Management System aboutus.php sql injection (CVSS 6.9, PHPGurukul Bank Locker Management System) - [CVE-2024-55279](https://cve.now/CVE-2024-55279.md): Uguu through 1.8.9 allows Cross Site Scripting (XSS) via JavaScript in XML files. (CVSS 6.0) - [CVE-2025-29100](https://cve.now/CVE-2025-29100.md): Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the fromSetRouteStatic function via the parameter list. (CVSS 9.8) - [CVE-2025-29135](https://cve.now/CVE-2025-29135.md): A stack-based buffer overflow vulnerability in Tenda AC7 V15.03.06.44 allows a remote attacker to execute arbitrary code through a stack ove (CVSS 9.8) - [CVE-2025-29310](https://cve.now/CVE-2025-29310.md): An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. (CVSS 9.8) - [CVE-2025-29311](https://cve.now/CVE-2025-29311.md): Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. (CVSS 7.5) - [CVE-2025-29312](https://cve.now/CVE-2025-29312.md): An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link t (CVSS 9.1) - [CVE-2025-29313](https://cve.now/CVE-2025-29313.md): Use of incorrectly resolved name or reference in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows att (CVSS 7.5, org.opendaylight.sfc:odl-sfc-openflow-renderer · org.openda…) - [CVE-2025-29314](https://cve.now/CVE-2025-29314.md): Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allow attackers to (CVSS 8.1, org.opendaylight.sfc:odl-sfc-ovs · org.opendaylight.sfc:odl…) - [CVE-2025-29315](https://cve.now/CVE-2025-29315.md): An issue in the Shiro-based RBAC (Role-based Access Control) mechanism of OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium (CVSS 9.8, org.opendaylight.sfc:sfc-parent) - [CVE-2025-30112](https://cve.now/CVE-2025-30112.md): On 70mai Dash Cam 1S devices, by connecting directly to the dashcam's network and accessing the API on port 80 and RTSP on port 554, an atta (CVSS 7.1) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-03-24 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.