# CVEs published 2025-03-25

137 CVEs were published on March 25, 2025: 14 critical, 42 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-2276](https://cve.now/CVE-2025-2276.md): Ultimate Dashboard \<= 3.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Modules Activation/Deactivation (CVSS 4.3, davidvongries Ultimate Dashboard – Custom WordPress Dashboa…)
- [CVE-2025-2302](https://cve.now/CVE-2025-2302.md): Advanced Woo Search \<= 3.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via aws\_search\_terms Shortcode (CVSS 6.4, mihail-barinov Advanced Woo Search – Product Search for Woo…)
- [CVE-2024-47516](https://cve.now/CVE-2024-47516.md): Pagure: argument injection in pagurerepo.log() (CVSS 9.8, pagure)
- [CVE-2025-30222](https://cve.now/CVE-2025-30222.md): Shescape has potential environment variable exposure on Windows with CMD (CVSS 2.1, ericcornelissen shescape · shescape)
- [CVE-2025-30219](https://cve.now/CVE-2025-30219.md): RabbitMQ has XSS Vulnerability in an Error Message in Management UI (CVSS 6.1, rabbitmq-server)
- [CVE-2025-29789](https://cve.now/CVE-2025-29789.md): OpenEMR Has Directory Traversal in Load Code feature (CVSS 4.6, openemr)
- [CVE-2025-30216](https://cve.now/CVE-2025-30216.md): CryptoLib Has Heap Overflow in Crypto\_TM\_ProcessSecurity due to Unchecked Secondary Header Length (CVSS 9.4, nasa CryptoLib)
- [CVE-2024-31896](https://cve.now/CVE-2024-31896.md): IBM SPSS Statistics information disclosure (CVSS 5.9, IBM SPSS Statistics)
- [CVE-2025-30567](https://cve.now/CVE-2025-30567.md): WordPress WP01 plugin \<= 2.6.2 - Arbitrary File Download Vulnerability (CVSS 7.5, WP01)
- [CVE-2025-28904](https://cve.now/CVE-2025-28904.md): WordPress Web Directory Free plugin \<= 1.7.6 - SQL Injection vulnerability (CVSS 9.3, Shamalli Web Directory Free)
- [CVE-2025-2312](https://cve.now/CVE-2025-2312.md): cifs.upcall makes an upcall to the wrong namespace in containerized environments (CVSS 5.9, cifs-utils)
- [CVE-2024-58105](https://cve.now/CVE-2024-58105.md): A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing s (CVSS 7.3, Trend Micro Apex One)
- [CVE-2024-58104](https://cve.now/CVE-2024-58104.md): A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing s (CVSS 7.3, Trend Micro Apex One)
- [CVE-2025-30214](https://cve.now/CVE-2025-30214.md): Frappe vulnerable to information disclosure leading to account takeover (CVSS 8.0, frappe)
- [CVE-2025-30213](https://cve.now/CVE-2025-30213.md): Frappe has Possibility of Remote Code Execution due to improper validation (CVSS 6.3, frappe)
- [CVE-2025-26742](https://cve.now/CVE-2025-26742.md): WordPress Gallery for Social Photo plugin \<= 1.0.0.35 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GhozyLab Gallery for Social Photo)
- [CVE-2025-27147](https://cve.now/CVE-2025-27147.md): GLPI Inventory plugin has Improper Access Control Vulnerability (CVSS 8.2, glpi-project glpi-inventory-plugin)
- [CVE-2025-30212](https://cve.now/CVE-2025-30212.md): Frappe has possibility of SQL injection due to improper validations (CVSS 6.6, frappe)
- [CVE-2025-2532](https://cve.now/CVE-2025-2532.md): Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Luxion KeyShot)
- [CVE-2025-2531](https://cve.now/CVE-2025-2531.md): Luxion KeyShot DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Luxion KeyShot)
- [CVE-2025-2530](https://cve.now/CVE-2025-2530.md): Luxion KeyShot DAE File Parsing Access of Uninitialized Pointer Remote Code Execution Vulnerability (CVSS 7.8, Luxion KeyShot)
- [CVE-2024-55604](https://cve.now/CVE-2024-55604.md): Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources (CVSS 4.8, appsmithorg appsmith)
- [CVE-2025-22230](https://cve.now/CVE-2025-22230.md): Authentication bypass vulnerability (CVSS 7.8, VMware Tools)
- [CVE-2025-27631](https://cve.now/CVE-2025-27631.md): The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execu (CVSS 6.5, Hitachi Energy TRMTracker)
- [CVE-2025-29932](https://cve.now/CVE-2025-29932.md): In JetBrains GoLand before 2025.1 an XXE during debugging was possible (CVSS 4.1, JetBrains GoLand)
- [CVE-2025-27633](https://cve.now/CVE-2025-27633.md): The TRMTracker web application is vulnerable to reflected Cross-site scripting attack. (CVSS 6.1, Hitachi Energy TRMTracker)
- [CVE-2025-1445](https://cve.now/CVE-2025-1445.md): A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61 (CVSS 8.7, Hitachi Energy RTU500)
- [CVE-2025-27632](https://cve.now/CVE-2025-27632.md): A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request (CVSS 6.1, Hitachi Energy TRMTracker)
- [CVE-2024-12169](https://cve.now/CVE-2024-12169.md): A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker perfo (CVSS 8.7, Hitachi Energy RTU500)
- [CVE-2024-11499](https://cve.now/CVE-2024-11499.md): A vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and authorized attacker to p (CVSS 6.9, Hitachi Energy RTU500)
- [CVE-2022-1804](https://cve.now/CVE-2022-1804.md): Accountsservice incorrectly drops privileges (CVSS 5.5, Ubuntu Linux)
- [CVE-2024-10037](https://cve.now/CVE-2024-10037.md): A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially cr (CVSS 5.9, Hitachi Energy RTU500)
- [CVE-2025-2109](https://cve.now/CVE-2025-2109.md): WP Compress \<= 6.30.15 - Unauthenticated Server-Side Request Forgery via init Function (CVSS 5.8, aresit WP Compress – Instant Performance & Speed Optimizati…)
- [CVE-2024-53679](https://cve.now/CVE-2024-53679.md): Apache VCL: XSS vulnerability in User Lookup impacting user privileges (CVSS 8.4, Apache Software Foundation Apache VCL)
- [CVE-2024-53678](https://cve.now/CVE-2024-53678.md): Apache VCL: SQL injection vulnerability in New Block Allocation form (CVSS 5.1, Apache Software Foundation Apache VCL)
- [CVE-2025-2757](https://cve.now/CVE-2025-2757.md): Open Asset Import Library Assimp MD5 File MD5Parser.cpp AI\_MD5\_PARSE\_STRING\_IN\_QUOTATION heap-based overflow (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-2756](https://cve.now/CVE-2025-2756.md): Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflow (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-2635](https://cve.now/CVE-2025-2635.md): Digital License Manager \<= 1.7.3 - Reflected Cross-Site Scripting via remove\_query\_arg Function (CVSS 6.1, codeverve Digital License Manager)
- [CVE-2025-2542](https://cve.now/CVE-2025-2542.md): Your Simple SVG Support \<= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, obbdpu Your Simple SVG Support)
- [CVE-2025-2755](https://cve.now/CVE-2025-2755.md): Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection out-of-bounds (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-2754](https://cve.now/CVE-2025-2754.md): Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflow (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-2753](https://cve.now/CVE-2025-2753.md): Open Asset Import Library Assimp LWS File LWSLoader.cpp MergeScenes out-of-bounds (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-2319](https://cve.now/CVE-2025-2319.md): EZ SQL Reports Shortcode Widget and DB Backup 4.11.13 - 5.25.08 - Cross-Site Request Forgery to Remote Code Execution (CVSS 8.8, scheeeli EZ SQL Reports Shortcode Widget and DB Backup)
- [CVE-2024-13690](https://cve.now/CVE-2024-13690.md): WP Church Donation \<= 1.7 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, ashishajani WP Church Donation)
- [CVE-2024-13731](https://cve.now/CVE-2024-13731.md): Alert Box Block – Display notice/alerts in the front end \<= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Box Block (CVSS 6.4, bplugins Alert Box Block – Display Custom Alerts and Messag…)
- [CVE-2024-13710](https://cve.now/CVE-2024-13710.md): Estatebud – Properties & Listings \<= 5.5.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, Estatebud – Properties & Listings)
- [CVE-2025-2510](https://cve.now/CVE-2025-2510.md): Frndzk Expandable Bottom Bar \<= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via text Parameter (CVSS 5.5, bittokazi Frndzk Expandable Bottom Bar)
- [CVE-2025-2559](https://cve.now/CVE-2025-2559.md): Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak (CVSS 4.9, keycloak · Red Hat Build of Keycloak +2)
- [CVE-2025-2752](https://cve.now/CVE-2025-2752.md): Open Asset Import Library Assimp CSM File fast\_atof.h fast\_atoreal\_move out-of-bounds (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-2751](https://cve.now/CVE-2025-2751.md): Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile out-of-bounds (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-2750](https://cve.now/CVE-2025-2750.md): Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile out-of-bounds write (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2024-12623](https://cve.now/CVE-2024-12623.md): DICOM Support \<= 0.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ivmartel DICOM Support)
- [CVE-2025-1320](https://cve.now/CVE-2025-1320.md): teachPress \<= 9.0.9 - Cross-Site Request Forgery to Import Delete (CVSS 4.3, winkm89 teachPress)
- [CVE-2025-2252](https://cve.now/CVE-2025-2252.md): Easy Digital Downloads – eCommerce Payments and Subscriptions made easy \<= 3.3.6.1 - Unauthenticated Private Post Title Disclosure (CVSS 5.3, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2025-2744](https://cve.now/CVE-2025-2744.md): zhijiantianya ruoyi-vue-pro Material Upload Interface upload-news-image path traversal (CVSS 5.3, zhijiantianya ruoyi-vue-pro)
- [CVE-2025-2743](https://cve.now/CVE-2025-2743.md): zhijiantianya ruoyi-vue-pro Material Upload Interface upload-temporary path traversal (CVSS 5.3, zhijiantianya ruoyi-vue-pro)
- [CVE-2025-2742](https://cve.now/CVE-2025-2742.md): zhijiantianya ruoyi-vue-pro Material Upload Interface upload-permanent path traversal (CVSS 5.3, zhijiantianya ruoyi-vue-pro)
- [CVE-2025-2740](https://cve.now/CVE-2025-2740.md): PHPGurukul Old Age Home Management System eligibility.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2025-1798](https://cve.now/CVE-2025-1798.md): Design Comuni Italia \< 1.1.2 - Unauthenticated Stored XSS (CVSS 6.1, design-comuni-wordpress-theme)
- [CVE-2025-1452](https://cve.now/CVE-2025-1452.md): Favorites \< 2.3.5 - Admin+ Stored XSS (CVSS 3.5, Favorites)
- [CVE-2025-0717](https://cve.now/CVE-2025-0717.md): Social Slider Feed \< 2.2.9 - Admin+ Stored XSS (CVSS 3.5, Social Slider Feed)
- [CVE-2024-9770](https://cve.now/CVE-2024-9770.md): WP-Recall \< 16.26.12 - Admin+ SQL Injection (CVSS 4.7, WP-Recall)
- [CVE-2024-13863](https://cve.now/CVE-2024-13863.md): Stylish Google Sheet Reader \< 4.1 - Reflected XSS (CVSS 7.1, Stylish Google Sheet Reader)
- [CVE-2024-13618](https://cve.now/CVE-2024-13618.md): Downloable by American Osteopathic Association \<= 0.1.0 - Unauthenticated SSRF (CVSS 7.2, aoa-downloadable)
- [CVE-2024-13617](https://cve.now/CVE-2024-13617.md): Downloable by American Osteopathic Association \<= 0.1.0 - Unauthenticated Arbitrary File Download (CVSS 8.6, aoa-downloadable)
- [CVE-2024-13123](https://cve.now/CVE-2024-13123.md): AFI \< 1.100.0 - Admin+ Stored XSS (CVSS 3.5, AFI)
- [CVE-2024-13122](https://cve.now/CVE-2024-13122.md): AFI \< 1.100.0 - Admin+ Stored XSS (CVSS 3.5, AFI)
- [CVE-2024-13118](https://cve.now/CVE-2024-13118.md): IP Based Login \< 2.4.1 - Log Deletion via CSRF (CVSS 4.3, IP Based Login)
- [CVE-2024-12769](https://cve.now/CVE-2024-12769.md): Simple Banner \< 3.0.4 - Admin+ Stored XSS (CVSS 3.5, Simple Banner)
- [CVE-2024-12682](https://cve.now/CVE-2024-12682.md): Smart Maintenance Mode \< 1.5.2 - Admin+ Stored XSS (CVSS 6.1, Smart Maintenance Mode)
- [CVE-2025-2739](https://cve.now/CVE-2025-2739.md): PHPGurukul Old Age Home Management System manage-services.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2024-12109](https://cve.now/CVE-2024-12109.md): Product Labels For Woocommerce \< 1.5.9 - Admin+ SQLi (CVSS 4.1, Product Labels For Woocommerce)
- [CVE-2024-11503](https://cve.now/CVE-2024-11503.md): WP Tabs \< 2.2.7 - Admin+ Stored XSS (CVSS 6.1, WP Tabs)
- [CVE-2024-11273](https://cve.now/CVE-2024-11273.md): Contact Form & SMTP Plugin for WordPress by PirateForms \< 2.6.0 - Admin+ Stored XSS (CVSS 6.1, Contact Form & SMTP Plugin for WordPress by PirateForms)
- [CVE-2024-11272](https://cve.now/CVE-2024-11272.md): Contact Form & SMTP Plugin for WordPress by PirateForms \< 2.6.0 - Admin+ Stored XSS (CVSS 6.1, Contact Form & SMTP Plugin for WordPress by PirateForms)
- [CVE-2024-10703](https://cve.now/CVE-2024-10703.md): Registrations for The Events Calendar \< 2.13.4 - Admin+ Stored XSS (CVSS 6.1, Registrations for the Events Calendar)
- [CVE-2024-10679](https://cve.now/CVE-2024-10679.md): Quiz and Survey Master (QSM) \< 9.2.1 - Author+ Stored XSS (CVSS 6.1, Quiz and Survey Master)
- [CVE-2024-10638](https://cve.now/CVE-2024-10638.md): Product Labels For Woocommerce \< 1.5.11 - Admin+ SQLi (CVSS 4.1, Product Labels For Woocommerce)
- [CVE-2024-10566](https://cve.now/CVE-2024-10566.md): Slider by 10Web \< 1.2.62 - Contributor+ Stored XSS (CVSS 6.1, Slider by 10Web)
- [CVE-2024-10565](https://cve.now/CVE-2024-10565.md): Slider by 10Web \< 1.2.62 - Admin+ Stored XSS via Widget (CVSS 6.1, Slider by 10Web)
- [CVE-2025-2738](https://cve.now/CVE-2025-2738.md): PHPGurukul Old Age Home Management System manage-scdetails.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2024-10560](https://cve.now/CVE-2024-10560.md): Form Maker by 10Web \< 1.15.30 - Admin+ Stored XSS (CVSS 3.5, Form Maker by 10Web)
- [CVE-2024-10554](https://cve.now/CVE-2024-10554.md): WP-Advanced-Search \< 3.3.9.3 - Admin+ Stored XSS (CVSS 3.5, WordPress WP-Advanced-Search)
- [CVE-2024-10472](https://cve.now/CVE-2024-10472.md): Stylish Price List \< 7.1.12 - Contributor+ Stored XSS (CVSS 5.9, Stylish Price List)
- [CVE-2024-10105](https://cve.now/CVE-2024-10105.md): Jobs for WordPress \< 2.7.11 - Contributor+ Stored XSS (CVSS 5.9, Job Postings)
- [CVE-2024-10210](https://cve.now/CVE-2024-10210.md): Path traversal in APROL Web Portal (CVSS 8.4, B&R Industrial Automation APROL)
- [CVE-2025-2737](https://cve.now/CVE-2025-2737.md): PHPGurukul Old Age Home Management System contactus.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2025-2224](https://cve.now/CVE-2025-2224.md): Directorist \<= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing (CVSS 5.3, wpwax Directorist: AI-Powered Business Directory, Listings…)
- [CVE-2025-0845](https://cve.now/CVE-2025-0845.md): DesignThemes Core Features \<= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, DesignThemes Core Features)
- [CVE-2025-2736](https://cve.now/CVE-2025-2736.md): PHPGurukul Old Age Home Management System bwdates-report-details.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2025-2735](https://cve.now/CVE-2025-2735.md): PHPGurukul Old Age Home Management System add-services.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2024-45484](https://cve.now/CVE-2024-45484.md): Enabled ICMP redirection in B&R APROL (CVSS 7.2, B&R Industrial Automation APROL)
- [CVE-2024-45483](https://cve.now/CVE-2024-45483.md): Missing GRUB password in B&R APROL (CVSS 7.0, B&R Industrial Automation APROL)
- [CVE-2024-45482](https://cve.now/CVE-2024-45482.md): Privilege escalation in B&R APROL (CVSS 8.5, B&R Industrial Automation B&R APROL)
- [CVE-2024-45481](https://cve.now/CVE-2024-45481.md): Improper authentication in SSH of B&R APROL (CVSS 8.5, B&R Industrial Automation B&R APROL)
- [CVE-2024-45480](https://cve.now/CVE-2024-45480.md): Unauthorized local file reading in B&R APROL (CVSS 9.2, B&R Industrial Automation B&R APROL)
- [CVE-2024-10209](https://cve.now/CVE-2024-10209.md): Incorrect Permission Assignment in APROL file system (CVSS 8.5, B&R Industrial Automation APROL)
- [CVE-2024-10208](https://cve.now/CVE-2024-10208.md): Cross Site Scripting vulnerability in APROL Web Portal (CVSS 5.1, B&R Industrial Automation APROL)
- [CVE-2024-10207](https://cve.now/CVE-2024-10207.md): Server-Side Request Forgery (authenticated) in APROL Web Portal (CVSS 5.3, B&R Industrial Automation APROL)
- [CVE-2024-10206](https://cve.now/CVE-2024-10206.md): Server-Side Request Forgery (unauthenticated) in APROL Web Portal (CVSS 6.9, B&R Industrial Automation APROL)
- [CVE-2024-8315](https://cve.now/CVE-2024-8315.md): Improper Handling of Insufficient Permissions or Privileges in B&R APROL (CVSS 6.8, B&R Industrial Automation B&R APROL)
- [CVE-2025-2734](https://cve.now/CVE-2025-2734.md): PHPGurukul Old Age Home Management System aboutus.php sql injection (CVSS 6.9, PHPGurukul Old Age Home Management System)
- [CVE-2025-2733](https://cve.now/CVE-2025-2733.md): mannaandpoem OpenManus Prompt python\_execute.py os command injection (CVSS 5.3, mannaandpoem OpenManus)
- [CVE-2024-8314](https://cve.now/CVE-2024-8314.md): Improper session handling in B&R APROL (CVSS 5.5, B&R Industrial Automation APROL)
- [CVE-2024-8313](https://cve.now/CVE-2024-8313.md): Default or Guessable SNMP community names in B&R APROL (CVSS 8.7, B&R Industrial Automation APROL)
- [CVE-2025-2732](https://cve.now/CVE-2025-2732.md): H3C Magic BE18000 HTTP POST Request getWifiNeighbour command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX30 Pro +3)
- [CVE-2025-2731](https://cve.now/CVE-2025-2731.md): H3C Magic BE18000 HTTP POST Request getDualbandSync command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX30 Pro +3)
- [CVE-2025-2730](https://cve.now/CVE-2025-2730.md): H3C Magic BE18000 HTTP POST Request getssidname command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX30 Pro +3)
- [CVE-2025-2729](https://cve.now/CVE-2025-2729.md): H3C Magic BE18000 HTTP POST Request networkSetup command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX30 Pro +3)
- [CVE-2025-2728](https://cve.now/CVE-2025-2728.md): H3C Magic NX30 Pro/Magic NX400 getNetworkConf command injection (CVSS 8.6, H3C Magic NX30 Pro · H3C Magic NX400)
- [CVE-2025-2727](https://cve.now/CVE-2025-2727.md): H3C Magic NX30 Pro HTTP POST Request getNetworkStatus command injection (CVSS 8.6, H3C Magic NX30 Pro)
- [CVE-2025-2726](https://cve.now/CVE-2025-2726.md): H3C Magic BE18000 HTTP POST Request esps command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX30 Pro +3)
- [CVE-2025-2725](https://cve.now/CVE-2025-2725.md): H3C Magic BE18000 HTTP POST Request auth command injection (CVSS 8.6, H3C Magic NX15 · H3C Magic NX30 Pro +3)
- [CVE-2024-42533](https://cve.now/CVE-2024-42533.md): SQL injection vulnerability in the authentication module in Convivance StandVoice 4.5 through 6.2 allows remote attackers to execute arbitra (CVSS 9.8)
- [CVE-2024-44903](https://cve.now/CVE-2024-44903.md): SQL Injection can occur in the SirsiDynix Horizon Information Portal (IPAC20) through 3.25\_9382; however, a patch is available from the vend (CVSS 7.5, SirsiDynix IPAC20)
- [CVE-2024-48818](https://cve.now/CVE-2024-48818.md): An issue in IIT Bombay, Mumbai, India Bodhitree of cs101 version allows a remote attacker to execute arbitrary code. (CVSS 9.8)
- [CVE-2024-55028](https://cve.now/CVE-2024-55028.md): A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted (CVSS 9.8, fprime)
- [CVE-2024-55029](https://cve.now/CVE-2024-55029.md): NASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities. (CVSS 6.1, fprime)
- [CVE-2024-55030](https://cve.now/CVE-2024-55030.md): A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands. (CVSS 9.8, fprime)
- [CVE-2025-25371](https://cve.now/CVE-2025-25371.md): NASA cFS (Core Flight System) Aquila is vulnerable to path traversal in the OSAL module, allowing the override of any arbitrary file on the (CVSS 7.5)
- [CVE-2025-25372](https://cve.now/CVE-2025-25372.md): NASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious telecommand to the Memory Management Module (CVSS 7.5)
- [CVE-2025-25373](https://cve.now/CVE-2025-25373.md): The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the (CVSS 9.8)
- [CVE-2025-25374](https://cve.now/CVE-2025-25374.md): In NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external (CVSS 7.5)
- [CVE-2025-27809](https://cve.now/CVE-2025-27809.md): Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unl (CVSS 5.4, mbedtls)
- [CVE-2025-27810](https://cve.now/CVE-2025-27810.md): Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory (CVSS 5.4, mbedtls)
- [CVE-2025-27830](https://cve.now/CVE-2025-27830.md): An issue was discovered in Artifex Ghostscript before 10.05.0. (CVSS 7.8)
- [CVE-2025-27831](https://cve.now/CVE-2025-27831.md): An issue was discovered in Artifex Ghostscript before 10.05.0. (CVSS 9.8)
- [CVE-2025-27832](https://cve.now/CVE-2025-27832.md): An issue was discovered in Artifex Ghostscript before 10.05.0. (CVSS 9.8)
- [CVE-2025-27833](https://cve.now/CVE-2025-27833.md): An issue was discovered in Artifex Ghostscript before 10.05.0. (CVSS 7.8)
- [CVE-2025-27834](https://cve.now/CVE-2025-27834.md): An issue was discovered in Artifex Ghostscript before 10.05.0. (CVSS 7.8)
- [CVE-2025-27835](https://cve.now/CVE-2025-27835.md): An issue was discovered in Artifex Ghostscript before 10.05.0. (CVSS 7.8)
- [CVE-2025-27836](https://cve.now/CVE-2025-27836.md): An issue was discovered in Artifex Ghostscript before 10.05.0. (CVSS 9.8)
- [CVE-2025-27837](https://cve.now/CVE-2025-27837.md): An issue was discovered in Artifex Ghostscript before 10.05.0. (CVSS 9.8)
- [CVE-2025-29635](https://cve.now/CVE-2025-29635.md): A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote (CVSS 7.2, KEV)
- [CVE-2025-30091](https://cve.now/CVE-2025-30091.md): In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. (CVSS 9.4, Tiny MoxieManager PHP)
- [CVE-2025-30118](https://cve.now/CVE-2025-30118.md): An issue was discovered on the Audi Universal Traffic Recorder 2.88. (CVSS 7.5)
- [CVE-2025-30741](https://cve.now/CVE-2025-30741.md): Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. (CVSS 4.3, Pixelfed · pixelfed/pixelfed)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.