CVEs published March 26, 2025
168 CVEs were published on March 26, 2025: 18 critical, 86 high. 1 is now in CISA KEV.
- Published
- 168
- Critical
- 18
- High
- 86
- Medium
- 56
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 36
Most affected products
- Splunk Enterprise · Splunk Cloud Platform
- 5
- Devolutions Remote Desktop Manager
- 4
- icingaweb2
- 4
- webtoffee Product Import Export for WooCommerce – Import Ex…
- 4
- mdempfle Advanced iFrame
- 3
- designingmedia Hostiko
- 2
- directus
- 2
- directus · @directus/storage-driver-s3
- 2
- discourse
- 2
- Silicon Labs Gecko OS
- 2
Critical 18
- CVE-2025-26941WordPress Church Admin plugin <= 5.0.18 - SQL Injection vulnerabilityandy_moyle Church Admin
- CVE-2025-30524WordPress Product Catalog plugin <= 1.0.4 - SQL Injection vulnerabilityorigincode Product Catalog
- CVE-2025-28942WordPress Trust Payments Gateway for WooCommerce plugin <= 1.1.4 - SQL Injection vulnerabilityTrust Payments Gateway for WooCommerce
- CVE-2025-28916WordPress Docpro plugin <= 2.0.1 - Local File Inclusion vulnerabilityRashid Docpro
- CVE-2025-28898WordPress WP Multistore Locator plugin <= 2.5.2 - SQL Injection vulnerabilityWPExperts.io WP Multistore Locator
- CVE-2025-28893WordPress Visual Text Editor plugin <= 1.2.1 - Remote Code Execution (RCE) vulnerabilityGovind Visual Text Editor
- CVE-2025-1542Improper permission control in OXARI ServiceDeskInfonet Projekt SA OXARI ServiceDesk
- CVE-2024-55964An issue was discovered in Appsmith before 1.52.
- CVE-2025-25535HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request.
- CVE-2025-26002Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setSyn
- CVE-2025-26003Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with set
- CVE-2025-26004Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack buffer overflow vulnerability when requesting admin.cgi parameter with setD
- CVE-2025-26005Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack overflow vulnerability when requesting admin.cgi parameter with setNtp.
- CVE-2025-26006Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setAutorest.
- CVE-2025-26007Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability in the login interface when requesting systemtil.cgi.
- CVE-2025-26008In Telesquare TLR-2005KSH 1.1.4, an unauthorized stack overflow vulnerability exists when requesting admin.cgi parameter with setSyncTimeHos
- CVE-2025-26010Telesquare TLR-2005KSH 1.1.4 allows unauthorized password modification when requesting the admin.cgi parameter with setUserNamePassword.
- CVE-2025-26011Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setUsernamePasswo
High 86
- CVE-2025-20229Remote Code Execution through file upload to “$SPLUNK_HOME/var/run/splunk/apptemp“ directory in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2025-20231Sensitive Information Disclosure in Splunk Secure Gateway AppSplunk Enterprise · Splunk Secure Gateway
- CVE-2025-2837Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution VulnerabilitySilicon Labs Gecko OS
- CVE-2025-2787Ingress-nginx vulnerability in KNIME Business HubKNIME Business Hub
- CVE-2025-30353Directus's webhook trigger flows can leak sensitive datadirectus
- CVE-2025-2783Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attackerGoogle Chrome
- CVE-2025-27406Icinga Reporting Stored XSS leads to SSRFicingaweb2-module-reporting
- CVE-2025-2098Dylib Hijacking in Fast CAD ReaderBeijing Honghu Yuntu Technology Fast CAD Reader
- CVE-2025-27405Icinga Web 2 has XSS in embedded contenticingaweb2
- CVE-2025-26986WordPress Pearl Theme < 3.4.8 - Local File Inclusion vulnerabilityStylemixThemes Pearl - Corporate Business
- CVE-2025-27014WordPress Hostiko Theme < 30.1 - Cross Site Scripting (XSS) vulnerabilitydesigningmedia Hostiko
- CVE-2025-27015WordPress Hostiko Theme < 30.1 - Local File Inclusion vulnerabilitydesigningmedia Hostiko
- CVE-2025-28939WordPress WP Google Calendar Manager plugin <= 2.1 - SQL Injection vulnerabilityEuroCizia WP Google Calendar Manager
- CVE-2025-28935WordPress Fancybox Plus plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilitypuzich Fancybox Plus
- CVE-2025-28934WordPress Simple Post Series plugin <= 2.4.4 - Reflected Cross Site Scripting (XSS) vulnerabilitychaozh Simple Post Series
- CVE-2025-28928WordPress Are you robot google recaptcha for Wordpress plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilitysureshdsk Are you robot google recaptcha for wordpress
- CVE-2025-28924WordPress ZenphotoPress plugin <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerabilitySimbul ZenphotoPress
- CVE-2025-28921WordPress SpatialMatch IDX plugin <= 3.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityhomejunction SpatialMatch IDX
- CVE-2025-28917WordPress Custom Smilies plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerabilitycrazyloong Custom Smilies
- CVE-2025-28911WordPress Gravity 2 PDF plugin <= 3.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilitygravity2pdf Gravity 2 PDF
- CVE-2025-28903WordPress Driving Directions plugin <= 1.4.4 - Reflected Cross Site Scripting (XSS) vulnerabilityhectorgarrofe Driving Directions
- CVE-2025-28899WordPress WP Event Ticketing plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerabilitytoddhuish WP Event Ticketing
- CVE-2025-28890WordPress Lightview Plus plugin <= 3.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilitypuzich Lightview Plus
- CVE-2025-28889WordPress Custom Product Stickers for Woocommerce plugin <= 1.9.0 - Reflected Cross Site Scripting (XSS) vulnerabilitystarblank Custom Product Stickers for Woocommerce
- CVE-2025-28882WordPress Omnify plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityOmnify
- CVE-2025-28880WordPress Blue Captcha plugin <= 1.7.4 - Reflected Cross Site Scripting (XSS) vulnerabilityjotis Blue Captcha
- CVE-2025-28877WordPress Key4ce osTicket Bridge plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilitym.tiggelaar Key4ce osTicket Bridge
- CVE-2025-28873WordPress Shuffle plugin <= 0.5 - SQL Injection vulnerabilityScott Taylor Shuffle
- CVE-2025-28869WordPress NextGEN Gallery Voting plugin <= 2.7.6 - Reflected Cross Site Scripting (XSS) vulnerabilityshauno NextGEN Gallery Voting
- CVE-2025-28865WordPress WP Colorful Tag Cloud plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilitylionelroux WP Colorful Tag Cloud
- CVE-2025-28858WordPress Arrow Maps plugin <= 1.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityArrow Plugins Arrow Maps
- CVE-2025-28855WordPress Teleport plugin <= 1.2.4 - Reflected Cross Site Scripting (XSS) vulnerabilitysrcoley Teleport
- CVE-2025-27267WordPress Random Quotes Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilitysrcoley Random Quotes
- CVE-2025-26584WordPress TBTestimonials Plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityTravis Ballard TBTestimonials
- CVE-2025-26583WordPress Video Share VOD plugin <= 2.7.9 - Reflected Cross-Site Scripting vulnerabilityvideowhisper Video Share VOD
- CVE-2025-26581WordPress Picture Gallery plugin <= 1.6.3 - CSRF to Stored XSS vulnerabilityvideowhisper Picture Gallery
- CVE-2025-26579WordPress MicroPayments Paid Membership plugin <= 3.2.4 - Reflected Cross-Site Scripting vulnerabilityvideowhisper MicroPayments
- CVE-2025-26576WordPress WP Simple Slideshow Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitytakumin WP Simple Slideshow
- CVE-2025-26575WordPress Display Post Meta plugin <= 1.5- Cross Site Scripting (XSS) vulnerabilityKyle Maurer Display Post Meta
- CVE-2025-26573WordPress Rizzi Guestbook plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityJamRizzi Technologies Rizzi Guestbook
- CVE-2025-26566WordPress In Stock Mailer for WooCommerce Plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityFrank In Stock Mailer for WooCommerce
- CVE-2025-26565WordPress GNUPress Plugin <= 0.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilitykagla GNUPress
- CVE-2025-26564WordPress GNUCommerce Plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilitykagla GNUCommerce
- CVE-2025-26560WordPress WP Contact Form III Plugin <= 1.6.2d - Reflected Cross Site Scripting (XSS) vulnerabilityKKWangen WP Contact Form III
- CVE-2025-26546WordPress Cookies Pro plugin <= 1.0 - CSRF to Stored XSS vulnerabilityPixelpro Cookies Pro
- CVE-2025-26544WordPressUTM tags + Landing page plugin <= 1.4 - CSRF to Stored XSS vulnerabilityMax K UTM tags tracking for Contact Form
- CVE-2025-26542WordPress Zalo Live Chat Plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityDang Ngoc Binh Zalo Live Chat
- CVE-2025-26541WordPress Bitcoin / AltCoin Payment Gateway for WooCommerce plugin <= 1.7.6 - Reflected Cross Site Scripting (XSS) vulnerabilityCodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce
- CVE-2025-26536WordPress Another Events Calendar Plugin <= 1.7.0 - Reflected Cross Site Scripting (XSS) vulnerabilityYendif Player Another Events Calendar
- CVE-2025-25134WordPress Theme Demo Bar Plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerabilityzenverse Theme Demo Bar
- CVE-2025-24690WordPress Formality Plugin <= 1.5.7 - Local File Inclusion vulnerabilityMichele Giorgi Formality
- CVE-2025-23964WordPress Google Plus Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityajitae Google Plus
- CVE-2025-23952WordPress Custom Field List Widget Plugin <= 1.5.1 - Local File Inclusion vulnerabilityntm custom-field-list-widget
- CVE-2025-23937WordPress LinkedIn Lite Plugin <= 1.0 - Local File Inclusion vulnerabilityAlex Furr LinkedIn Lite
- CVE-2025-23735WordPress Infugrator plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityCosmin Schiopu Infugrator
- CVE-2025-23728WordPress AuMenu plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityatelierhyper AuMenu
- CVE-2025-23714WordPress AppReview plugin <= 0.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilitypodspod AppReview
- CVE-2025-23704WordPress Your Lightbox plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityReuven Karasik Your Lightbox
- CVE-2025-23680WordPress Narnoo Operator plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityNarnoo Operator
- CVE-2025-23666WordPress Management-screen-droptiles plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitycxc-sawa Management-screen-droptiles
- CVE-2025-23638WordPress Frontend Post Submission plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityUmesh Ghimire Frontend Post Submission
- CVE-2025-23633WordPress WP Database Audit plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitykhanhtruong WP Database Audit
- CVE-2025-23632WordPress CG Button plugin <= 1.0.5.6 - Reflected Cross Site Scripting (XSS) vulnerabilityRhizome Networks CG Button
- CVE-2025-23612WordPress Pixobe Cartography plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityPixobe Cartography
- CVE-2025-23546WordPress RDP inGroups+ plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityRobert D Payne RDP inGroups+
- CVE-2025-23543WordPress FOMO Pay Chinese Payment Solution plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityfomopay FOMO Pay Chinese Payment Solution
- CVE-2025-23542WordPress RDP Linkedin Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityRobert D Payne RDP Linkedin Login
- CVE-2025-23466WordPress Site Editor Google Map plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilitywpsiteeditor Site Editor Google Map
- CVE-2025-23460WordPress RWS Enquiry And Lead Follow-up plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityrhizomaticweb RWS Enquiry And Lead Follow-up
- CVE-2025-23459WordPress NS Simple Intro Loader plugin <= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityNsThemes NS Simple Intro Loader
- CVE-2025-22283WordPress GetSocial Plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityRiyaz GetSocial
- CVE-2025-27404Icinga Web 2 DOM-based XSS vulnerabilityicingaweb2
- CVE-2024-45351Game center application has code execution VulnerabilityXiaomi Game center application
- CVE-2025-1913Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameterwebtoffee Product Import Export for WooCommerce – Import Ex…
- CVE-2025-1912Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Functionwebtoffee Product Import Export for WooCommerce – Import Ex…
- CVE-2024-13889WordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injectionwordpressdotorg WordPress Importer
- CVE-2025-2110WP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functionsaresit WP Compress – Instant Performance & Speed Optimizati…
- CVE-2024-13801BWL Advanced FAQ Manager <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Updatexenioushk BWL Advanced FAQ Manager
- CVE-2025-1514Active Products Tables for WooCommerce <= 1.0.6.7 - Unauthenticated Arbitrary Filter Callrealmag777 Active Products Tables for WooCommerce. Use cons…
- CVE-2025-2009Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scriptingcontrid Newsletters
- CVE-2025-2257Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command InjectionTotal Upkeep – WordPress Backup Plugin plus Restore & Migra…
- CVE-2024-13146Booknetic < 4.1.5 - Staff Creation via CSRFBooknetic
- CVE-2025-26001Telesquare TLR-2005KSH 1.1.4 is vulnerable to Information Disclosure via the parameter getUserNamePassword.
- CVE-2025-26009Telesquare TLR-2005KSH 1.1.4 has an Information Disclosure vulnerability when requesting systemutilit.cgi.
- CVE-2025-28361Unauthorized stack overflow vulnerability in Telesquare TLR-2005KSH v.1.1.4 allows a remote attacker to obtain sensitive information via the
- CVE-2025-30073An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0.
Medium, low and unrated 64
- CVE-2025-20230Missing Access Control and Incorrect Ownership of Data in App Key Value Store (KVStore) collections in the Splunk Secure Gateway AppSplunk Enterprise · Splunk Secure Gateway
- CVE-2025-20233Incorrect permissions set by the “chmod“ and “makedirs“ Python functions in Splunk App for Lookup File EditingSplunk App for Lookup File Editing
- CVE-2025-20232Risky Command Safeguards Bypass in “/app/search/search“ endpoint through “s“ parameter in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2025-20228Maintenance mode state change of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF) in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2025-20227Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard StudioSplunk Enterprise · Splunk Cloud Platform
- CVE-2025-20226Risky command safeguards bypass in “/services/streams/search“ endpoint through “q“ parameter in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2025-30407Local privilege escalation due to a binary hijacking vulnerability.Acronis Cyber Protect Cloud Agent
- CVE-2025-2838Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service VulnerabilitySilicon Labs Gecko OS
- CVE-2025-2600Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELDevolutions Remote Desktop Manager
- CVE-2025-2562Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a storedDevolutions Remote Desktop Manager
- CVE-2025-2528Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use Devolutions Remote Desktop Manager
- CVE-2025-30352Directus `search` query parameter allows enumeration of non permitted fieldsdirectus
- CVE-2025-2499Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows.Devolutions Remote Desktop Manager
- CVE-2025-30351Suspended Directus user can continue to use session token to access APIdirectus · @directus/api +1
- CVE-2025-30350Directus's S3 assets become unavailable after a burst of HEAD requestsdirectus · @directus/storage-driver-s3
- CVE-2025-30225Directus's S3 assets become unavailable after a burst of malformed transformationsdirectus · @directus/storage-driver-s3
- CVE-2025-30217Frappe has possibility of SQL injection due to improper validationsfrappe
- CVE-2025-30164Icinga Web 2 has open redirect on login pageicingaweb2
- CVE-2025-27609Icinga Web 2 Vulnerable to Reflected XSSicingaweb2
- CVE-2025-26739WordPress newseqo theme <= 2.1.1 - Stored Cross Site Scripting (XSS) vulnerabilitythemefunction newseqo
- CVE-2025-2820Denial of ServiceBizerba SE & Co. KG Product family GLx and CWx
- CVE-2025-26747WordPress RainbowNews theme <= 1.0.7 - Cross Site Scripting (XSS) vulnerability99colorthemes RainbowNews
- CVE-2025-2819Unrestricted FileuploadBizerba SE & Co. KG GT-SoftControl
- CVE-2025-26869WordPress Build theme <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityBuild
- CVE-2025-26922WordPress AuraMart theme <= 2.0.7 - Cross Site Scripting (XSS) vulnerabilitytechthemes AuraMart
- CVE-2025-26923WordPress Event post plugin <= 5.9.8 - Cross Site Scripting (XSS) vulnerabilityBastien Ho Event post
- CVE-2025-26929WordPress Accounting for WooCommerce plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerabilityBastien Ho Accounting for WooCommerce
- CVE-2025-28885WordPress Fiverr.com Official Search Box plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityfiverraffiliates Fiverr.com Official Search Box
- CVE-2025-26559WordPress Secure Invites plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityChris Taylor Secure Invites
- CVE-2025-26537WordPress GDPR Tools plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityrolomak GDPR Tools
- CVE-2025-24972Discourse may bypass user preference when adding users to chat groupsdiscourse
- CVE-2025-24808Discourse has race condition when adding users to a group DMdiscourse
- CVE-2022-39163IBM Cognos Controller HTTP response smugglingIBM Cognos Controller · IBM Controller
- CVE-2025-23203Icinga has rest API endpoints accessible to restricted usersicingaweb2-module-director
- CVE-2025-2228Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.8 - Authenticated (Contributor+) Sensitive Information Exposurecyberchimps Responsive Addons for Elementor – Free Elemento…
- CVE-2025-1911Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Functionwebtoffee Product Import Export for WooCommerce – Import Ex…
- CVE-2025-1312Ultimate Blocks – WordPress Blocks Plugin <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for B…
- CVE-2024-13411Zapier for WordPress <= 1.5.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via updated_user FunctionZapier for WordPress
- CVE-2025-1769Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Functionwebtoffee Product Import Export for WooCommerce – Import Ex…
- CVE-2025-27552DBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Crypt/Eksblowfish/Bcrypt.pmWREIS DBIx::Class::EncodedColumn
- CVE-2025-27551DBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Digest.pmWREIS DBIx::Class::EncodedColumn
- CVE-2025-2596Session logout can be overwritten by long lasting requestCheckmk
- CVE-2025-1440Advanced iFrame <= 2024.5 - Unauthenticated Settings Updatemdempfle Advanced iFrame
- CVE-2025-1703Ultimate Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameterultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for B…
- CVE-2025-1437Advanced iFrame <= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingmdempfle Advanced iFrame
- CVE-2025-1439Advanced iFrame <= 2024.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Host Headermdempfle Advanced iFrame
- CVE-2025-1310Jobs for WordPress <= 2.7.11 - Authenticated (Subscriber+) Arbitrary File Readblueglassch Job Postings
- CVE-2024-13702CRM and Lead Management by vcita <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingCRM and Lead Management by vcita
- CVE-2025-2167Event post <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingbastho Event post
- CVE-2024-30155HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerabilityHCL Software HCL SX
- CVE-2023-52972Huawei PCs have a vulnerability that allows low-privilege users to bypass SDDL permission checks .Huawei YutuFZ-5651S1
- CVE-2024-12683Smart Maintenance Mode < 1.5.2 - Admin+ Stored XSSSmart Maintenance Mode
- CVE-2024-11847WP SVG Upload <= 1.0.0 - Author+ Stored XSS via SVGwp-svg-upload · digimix/wp-svg-upload
- CVE-2025-1784Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrainstormforce Spectra Gutenberg Blocks – Website Builder…
- CVE-2025-1490Smart Maintenance Mode <= 1.5.2 - Reflected Cross-Site Scripting via setstatus Parameterbrijeshk89 Smart Maintenance Mode
- CVE-2025-2165SH Email Alert <= 1.0 - Reflected Cross-Site Scriptingsamhoamt SH Email Alert
- CVE-2025-2573Amazing service box Addons For WPBakery Page Builder <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadzia420 Amazing service box Addons For WPBakery Page Builder
- CVE-2025-2576Ayyash Studio <= 1.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadthemerox Ayyash Studio — The kick-start kit
- CVE-2024-41643An issue in Arris NVG443B 9.3.0h3d36 allows a physically proximate attacker to execute arbitrary code via the cshell login component.
- CVE-2024-55963An issue was discovered in Appsmith before 1.51.
- CVE-2024-55965An issue was discovered in Appsmith before 1.51.
- CVE-2025-29322A cross-site scripting (XSS) vulnerability in ScriptCase before v1.0.003 - Build 3 allows attackers to execute arbitrary code via a crafted
- CVE-2025-30742httpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character req string would not hapizhenwei atophttpd
- CVE-2025-31160atop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecifatop project atop