CVEs published March 25, 2025
137 CVEs were published on March 25, 2025: 14 critical, 42 high. 1 is now in CISA KEV.
- Published
- 137
- Critical
- 14
- High
- 42
- Medium
- 73
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 64
Most affected products
- B&R Industrial Automation APROL
- 9
- Open Asset Import Library Assimp · pyassimp
- 8
- PHPGurukul Old Age Home Management System
- 7
- H3C Magic NX15 · H3C Magic NX30 Pro +3
- 6
- B&R Industrial Automation B&R APROL
- 4
- Hitachi Energy RTU500
- 4
- fprime
- 3
- frappe
- 3
- Hitachi Energy TRMTracker
- 3
- Luxion KeyShot
- 3
Critical 14
- CVE-2024-47516Pagure: argument injection in pagurerepo.log()pagure
- CVE-2025-30216CryptoLib Has Heap Overflow in Crypto_TM_ProcessSecurity due to Unchecked Secondary Header Lengthnasa CryptoLib
- CVE-2025-28904WordPress Web Directory Free plugin <= 1.7.6 - SQL Injection vulnerabilityShamalli Web Directory Free
- CVE-2024-45480Unauthorized local file reading in B&R APROLB&R Industrial Automation B&R APROL
- CVE-2024-42533SQL injection vulnerability in the authentication module in Convivance StandVoice 4.5 through 6.2 allows remote attackers to execute arbitra
- CVE-2024-48818An issue in IIT Bombay, Mumbai, India Bodhitree of cs101 version allows a remote attacker to execute arbitrary code.
- CVE-2024-55028A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a craftedfprime
- CVE-2024-55030A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands.fprime
- CVE-2025-25373The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the
- CVE-2025-27831An issue was discovered in Artifex Ghostscript before 10.05.0.
- CVE-2025-27832An issue was discovered in Artifex Ghostscript before 10.05.0.
- CVE-2025-27836An issue was discovered in Artifex Ghostscript before 10.05.0.
- CVE-2025-27837An issue was discovered in Artifex Ghostscript before 10.05.0.
- CVE-2025-30091In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command.Tiny MoxieManager PHP
High 42
- CVE-2025-30567WordPress WP01 plugin <= 2.6.2 - Arbitrary File Download VulnerabilityWP01
- CVE-2024-58105A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing sTrend Micro Apex One
- CVE-2024-58104A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing sTrend Micro Apex One
- CVE-2025-30214Frappe vulnerable to information disclosure leading to account takeoverfrappe
- CVE-2025-27147GLPI Inventory plugin has Improper Access Control Vulnerabilityglpi-project glpi-inventory-plugin
- CVE-2025-2532Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution VulnerabilityLuxion KeyShot
- CVE-2025-2531Luxion KeyShot DAE File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityLuxion KeyShot
- CVE-2025-2530Luxion KeyShot DAE File Parsing Access of Uninitialized Pointer Remote Code Execution VulnerabilityLuxion KeyShot
- CVE-2025-22230Authentication bypass vulnerabilityVMware Tools
- CVE-2025-1445A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61Hitachi Energy RTU500
- CVE-2024-12169A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker perfoHitachi Energy RTU500
- CVE-2024-53679Apache VCL: XSS vulnerability in User Lookup impacting user privilegesApache Software Foundation Apache VCL
- CVE-2025-2319EZ SQL Reports Shortcode Widget and DB Backup 4.11.13 - 5.25.08 - Cross-Site Request Forgery to Remote Code Executionscheeeli EZ SQL Reports Shortcode Widget and DB Backup
- CVE-2024-13690WP Church Donation <= 1.7 - Unauthenticated Stored Cross-Site Scriptingashishajani WP Church Donation
- CVE-2024-13863Stylish Google Sheet Reader < 4.1 - Reflected XSSStylish Google Sheet Reader
- CVE-2024-13618Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated SSRFaoa-downloadable
- CVE-2024-13617Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Arbitrary File Downloadaoa-downloadable
- CVE-2024-10210Path traversal in APROL Web PortalB&R Industrial Automation APROL
- CVE-2024-45484Enabled ICMP redirection in B&R APROLB&R Industrial Automation APROL
- CVE-2024-45483Missing GRUB password in B&R APROLB&R Industrial Automation APROL
- CVE-2024-45482Privilege escalation in B&R APROLB&R Industrial Automation B&R APROL
- CVE-2024-45481Improper authentication in SSH of B&R APROLB&R Industrial Automation B&R APROL
- CVE-2024-10209Incorrect Permission Assignment in APROL file systemB&R Industrial Automation APROL
- CVE-2024-8313Default or Guessable SNMP community names in B&R APROLB&R Industrial Automation APROL
- CVE-2025-2732H3C Magic BE18000 HTTP POST Request getWifiNeighbour command injectionH3C Magic NX15 · H3C Magic NX30 Pro +3
- CVE-2025-2731H3C Magic BE18000 HTTP POST Request getDualbandSync command injectionH3C Magic NX15 · H3C Magic NX30 Pro +3
- CVE-2025-2730H3C Magic BE18000 HTTP POST Request getssidname command injectionH3C Magic NX15 · H3C Magic NX30 Pro +3
- CVE-2025-2729H3C Magic BE18000 HTTP POST Request networkSetup command injectionH3C Magic NX15 · H3C Magic NX30 Pro +3
- CVE-2025-2728H3C Magic NX30 Pro/Magic NX400 getNetworkConf command injectionH3C Magic NX30 Pro · H3C Magic NX400
- CVE-2025-2727H3C Magic NX30 Pro HTTP POST Request getNetworkStatus command injectionH3C Magic NX30 Pro
- CVE-2025-2726H3C Magic BE18000 HTTP POST Request esps command injectionH3C Magic NX15 · H3C Magic NX30 Pro +3
- CVE-2025-2725H3C Magic BE18000 HTTP POST Request auth command injectionH3C Magic NX15 · H3C Magic NX30 Pro +3
- CVE-2024-44903SQL Injection can occur in the SirsiDynix Horizon Information Portal (IPAC20) through 3.25_9382; however, a patch is available from the vendSirsiDynix IPAC20
- CVE-2025-25371NASA cFS (Core Flight System) Aquila is vulnerable to path traversal in the OSAL module, allowing the override of any arbitrary file on the
- CVE-2025-25372NASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious telecommand to the Memory Management Module
- CVE-2025-25374In NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external
- CVE-2025-27830An issue was discovered in Artifex Ghostscript before 10.05.0.
- CVE-2025-27833An issue was discovered in Artifex Ghostscript before 10.05.0.
- CVE-2025-27834An issue was discovered in Artifex Ghostscript before 10.05.0.
- CVE-2025-27835An issue was discovered in Artifex Ghostscript before 10.05.0.
- CVE-2025-29635A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote
- CVE-2025-30118An issue was discovered on the Audi Universal Traffic Recorder 2.88.
Medium, low and unrated 81
- CVE-2025-2276Ultimate Dashboard <= 3.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Modules Activation/Deactivationdavidvongries Ultimate Dashboard – Custom WordPress Dashboa…
- CVE-2025-2302Advanced Woo Search <= 3.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via aws_search_terms Shortcodemihail-barinov Advanced Woo Search – Product Search for Woo…
- CVE-2025-30222Shescape has potential environment variable exposure on Windows with CMDericcornelissen shescape · shescape
- CVE-2025-30219RabbitMQ has XSS Vulnerability in an Error Message in Management UIrabbitmq-server
- CVE-2025-29789OpenEMR Has Directory Traversal in Load Code featureopenemr
- CVE-2024-31896IBM SPSS Statistics information disclosureIBM SPSS Statistics
- CVE-2025-2312cifs.upcall makes an upcall to the wrong namespace in containerized environmentscifs-utils
- CVE-2025-30213Frappe has Possibility of Remote Code Execution due to improper validationfrappe
- CVE-2025-26742WordPress Gallery for Social Photo plugin <= 1.0.0.35 - Cross Site Scripting (XSS) vulnerabilityGhozyLab Gallery for Social Photo
- CVE-2025-30212Frappe has possibility of SQL injection due to improper validationsfrappe
- CVE-2024-55604Appsmith's Broken Access Control Allows Viewer Role User to Query Datasourcesappsmithorg appsmith
- CVE-2025-27631The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execuHitachi Energy TRMTracker
- CVE-2025-29932In JetBrains GoLand before 2025.1 an XXE during debugging was possibleJetBrains GoLand
- CVE-2025-27633The TRMTracker web application is vulnerable to reflected Cross-site scripting attack.Hitachi Energy TRMTracker
- CVE-2025-27632A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request Hitachi Energy TRMTracker
- CVE-2024-11499A vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and authorized attacker to pHitachi Energy RTU500
- CVE-2022-1804Accountsservice incorrectly drops privilegesUbuntu Linux
- CVE-2024-10037A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crHitachi Energy RTU500
- CVE-2025-2109WP Compress <= 6.30.15 - Unauthenticated Server-Side Request Forgery via init Functionaresit WP Compress – Instant Performance & Speed Optimizati…
- CVE-2024-53678Apache VCL: SQL injection vulnerability in New Block Allocation formApache Software Foundation Apache VCL
- CVE-2025-2757Open Asset Import Library Assimp MD5 File MD5Parser.cpp AI_MD5_PARSE_STRING_IN_QUOTATION heap-based overflowOpen Asset Import Library Assimp · pyassimp
- CVE-2025-2756Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflowOpen Asset Import Library Assimp · pyassimp
- CVE-2025-2635Digital License Manager <= 1.7.3 - Reflected Cross-Site Scripting via remove_query_arg Functioncodeverve Digital License Manager
- CVE-2025-2542Your Simple SVG Support <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadobbdpu Your Simple SVG Support
- CVE-2025-2755Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection out-of-boundsOpen Asset Import Library Assimp · pyassimp
- CVE-2025-2754Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflowOpen Asset Import Library Assimp · pyassimp
- CVE-2025-2753Open Asset Import Library Assimp LWS File LWSLoader.cpp MergeScenes out-of-boundsOpen Asset Import Library Assimp · pyassimp
- CVE-2024-13731Alert Box Block – Display notice/alerts in the front end <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Box Blockbplugins Alert Box Block – Display Custom Alerts and Messag…
- CVE-2024-13710Estatebud – Properties & Listings <= 5.5.0 - Cross-Site Request Forgery to Settings UpdateEstatebud – Properties & Listings
- CVE-2025-2510Frndzk Expandable Bottom Bar <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via text Parameterbittokazi Frndzk Expandable Bottom Bar
- CVE-2025-2559Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloakkeycloak · Red Hat Build of Keycloak +2
- CVE-2025-2752Open Asset Import Library Assimp CSM File fast_atof.h fast_atoreal_move out-of-boundsOpen Asset Import Library Assimp · pyassimp
- CVE-2025-2751Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile out-of-boundsOpen Asset Import Library Assimp · pyassimp
- CVE-2025-2750Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile out-of-bounds writeOpen Asset Import Library Assimp · pyassimp
- CVE-2024-12623DICOM Support <= 0.10.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingivmartel DICOM Support
- CVE-2025-1320teachPress <= 9.0.9 - Cross-Site Request Forgery to Import Deletewinkm89 teachPress
- CVE-2025-2252Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosuresmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2025-2744zhijiantianya ruoyi-vue-pro Material Upload Interface upload-news-image path traversalzhijiantianya ruoyi-vue-pro
- CVE-2025-2743zhijiantianya ruoyi-vue-pro Material Upload Interface upload-temporary path traversalzhijiantianya ruoyi-vue-pro
- CVE-2025-2742zhijiantianya ruoyi-vue-pro Material Upload Interface upload-permanent path traversalzhijiantianya ruoyi-vue-pro
- CVE-2025-2740PHPGurukul Old Age Home Management System eligibility.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-1798Design Comuni Italia < 1.1.2 - Unauthenticated Stored XSSdesign-comuni-wordpress-theme
- CVE-2025-1452Favorites < 2.3.5 - Admin+ Stored XSSFavorites
- CVE-2025-0717Social Slider Feed < 2.2.9 - Admin+ Stored XSSSocial Slider Feed
- CVE-2024-9770WP-Recall < 16.26.12 - Admin+ SQL InjectionWP-Recall
- CVE-2024-13123AFI < 1.100.0 - Admin+ Stored XSSAFI
- CVE-2024-13122AFI < 1.100.0 - Admin+ Stored XSSAFI
- CVE-2024-13118IP Based Login < 2.4.1 - Log Deletion via CSRFIP Based Login
- CVE-2024-12769Simple Banner < 3.0.4 - Admin+ Stored XSSSimple Banner
- CVE-2024-12682Smart Maintenance Mode < 1.5.2 - Admin+ Stored XSSSmart Maintenance Mode
- CVE-2025-2739PHPGurukul Old Age Home Management System manage-services.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2024-12109Product Labels For Woocommerce < 1.5.9 - Admin+ SQLiProduct Labels For Woocommerce
- CVE-2024-11503WP Tabs < 2.2.7 - Admin+ Stored XSSWP Tabs
- CVE-2024-11273Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSSContact Form & SMTP Plugin for WordPress by PirateForms
- CVE-2024-11272Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSSContact Form & SMTP Plugin for WordPress by PirateForms
- CVE-2024-10703Registrations for The Events Calendar < 2.13.4 - Admin+ Stored XSSRegistrations for the Events Calendar
- CVE-2024-10679Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSSQuiz and Survey Master
- CVE-2024-10638Product Labels For Woocommerce < 1.5.11 - Admin+ SQLiProduct Labels For Woocommerce
- CVE-2024-10566Slider by 10Web < 1.2.62 - Contributor+ Stored XSSSlider by 10Web
- CVE-2024-10565Slider by 10Web < 1.2.62 - Admin+ Stored XSS via WidgetSlider by 10Web
- CVE-2025-2738PHPGurukul Old Age Home Management System manage-scdetails.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2024-10560Form Maker by 10Web < 1.15.30 - Admin+ Stored XSSForm Maker by 10Web
- CVE-2024-10554WP-Advanced-Search < 3.3.9.3 - Admin+ Stored XSSWordPress WP-Advanced-Search
- CVE-2024-10472Stylish Price List < 7.1.12 - Contributor+ Stored XSSStylish Price List
- CVE-2024-10105Jobs for WordPress < 2.7.11 - Contributor+ Stored XSSJob Postings
- CVE-2025-2737PHPGurukul Old Age Home Management System contactus.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-2224Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishingwpwax Directorist: AI-Powered Business Directory, Listings…
- CVE-2025-0845DesignThemes Core Features <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeDesignThemes Core Features
- CVE-2025-2736PHPGurukul Old Age Home Management System bwdates-report-details.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-2735PHPGurukul Old Age Home Management System add-services.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2024-10208Cross Site Scripting vulnerability in APROL Web PortalB&R Industrial Automation APROL
- CVE-2024-10207Server-Side Request Forgery (authenticated) in APROL Web PortalB&R Industrial Automation APROL
- CVE-2024-10206Server-Side Request Forgery (unauthenticated) in APROL Web PortalB&R Industrial Automation APROL
- CVE-2024-8315Improper Handling of Insufficient Permissions or Privileges in B&R APROLB&R Industrial Automation B&R APROL
- CVE-2025-2734PHPGurukul Old Age Home Management System aboutus.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-2733mannaandpoem OpenManus Prompt python_execute.py os command injectionmannaandpoem OpenManus
- CVE-2024-8314Improper session handling in B&R APROLB&R Industrial Automation APROL
- CVE-2024-55029NASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.fprime
- CVE-2025-27809Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unlmbedtls
- CVE-2025-27810Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory mbedtls
- CVE-2025-30741Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers.Pixelfed · pixelfed/pixelfed