CVEs published March 28, 2025
172 CVEs were published on March 28, 2025: 17 critical, 55 high.
- Published
- 172
- Critical
- 17
- High
- 55
- Medium
- 92
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 47
Most affected products
- Dell Unity
- 15
- Arteche saTECH BCU
- 8
- HDF5
- 8
- KDDI HGW-BL1500HM
- 6
- Netis WF-2404
- 4
- Clinic Queuing System
- 3
- Fermax MeetMe
- 3
- IBM InfoSphere Information Server
- 3
- MISP
- 3
- shopxo/shopxo
- 3
Critical 17
- CVE-2025-22526WordPress PHP/MySQL CPU performance statistics Plugin <= 1.2.1 - PHP Object Injection vulnerabilitymywebtonet PHP/MySQL CPU performance statistics
- CVE-2025-22523WordPress Schedule Plugin <= 1.0.0 - SQL Injection vulnerabilityscheduler Schedule
- CVE-2025-2294Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusionextendthemes Kubio AI Page Builder
- CVE-2025-22398Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2025-24383Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2024-24292A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function in the aim.js compo
- CVE-2024-38985janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/indepath · cool-path
- CVE-2024-38988alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js.@alizeait/unflatto
- CVE-2024-56975InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file
- CVE-2025-22953A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.57
- CVE-2025-25579TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr.
- CVE-2025-28087Sourcecodester Online Exam System 1.0 is vulnerable to SQL Injection via dash.php.
- CVE-2025-28089maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.
- CVE-2025-28090maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.
- CVE-2025-28091maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.
- CVE-2025-28219Netgear DC112A V1.0.0.64 has an OS command injection vulnerability in the usb_adv.cgi, which allows remote attackers to execute arbitrary co
- CVE-2025-28256An issue in TOTOLINK A3100R V4.1.2cu.5247_B20211129 allows a remote attacker to execute arbitrary code via the setWebWlanIdx of the file /li
High 55
- CVE-2025-2919Netis WF-2404 UART hardware allows activation of test or debug logic at runtimeNetis WF-2404
- CVE-2025-22767WordPress GlobalPayments WooCommerce Plugin <= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerabilityGlobal Payments GlobalPayments WooCommerce
- CVE-2025-22575WordPress SUPER RESPONSIVE SLIDER Plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityextendyourweb SUPER RESPONSIVE SLIDER
- CVE-2025-22566WordPress ULTIMATE VIDEO GALLERY Plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityextendyourweb ULTIMATE VIDEO GALLERY
- CVE-2025-22501WordPress Improve My City plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityImprove My City
- CVE-2025-22360WordPress WP Azure offload plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilitypromact WP Azure offload
- CVE-2025-22356WordPress Stencies plugin <= 0.58 - Reflected Cross Site Scripting (XSS) vulnerabilityStencies
- CVE-2024-54362WordPress GetShop ecommerce plugin <= 1.3 - Path Traversal vulnerabilityboggibill GetShop ecommerce
- CVE-2024-54291WordPress PluginPass plugin <= 0.9.10 - Arbitrary File Download/Delete vulnerabilitylabs64 PluginPass
- CVE-2024-51624WordPress Já-Já Pagamentos for WooCommerce plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityjajapagamentos Já-Já Pagamentos for WooCommerce
- CVE-2025-30211KEX init error results with excessive memory usageerlang otp
- CVE-2025-30372Emlog Pro contains an SQL injection vulnerability.emlog
- CVE-2025-29928authentik's deletion of sessions did not revoke sessions when using database session storagegoauthentik authentik
- CVE-2025-1781There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce serW3C CSS Validator
- CVE-2025-2858Privilege escalation vulnerability in saTECH BCUArteche saTECH BCU
- CVE-2024-7407Weak password encoding in Streamsoft PrestiżStreamsoft Prestiż
- CVE-2024-11504SQL Injection in Streamsoft PrestiżStreamsoft Prestiż
- CVE-2025-2908Insufficiently Protected Credentials vulnerability in MeetMe productsFermax MeetMe
- CVE-2025-31432WordPress Pop-Up Chop Chop plugin <= 2.1.7 - Local File Inclusion VulnerabilityPop-Up Chop Chop
- CVE-2025-31435WordPress Microblog Poster plugin <= 2.1.6 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityEfficient Scripts Microblog Poster
- CVE-2025-31440WordPress Terms of Use plugin <= 2.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityStrategy11 Team Terms of Use
- CVE-2025-31443WordPress KK I Like It plugin <= 1.7.5.3 - CSRF to Stored XSS vulnerabilityKrzysztof Furtak KK I Like It
- CVE-2025-31444WordPress ShowTime Slideshow plugin <= 1.6 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityyoutag ShowTime Slideshow
- CVE-2025-31449WordPress The Visitor Counter plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityEricH The Visitor Counter
- CVE-2025-31458WordPress Video Embedder plugin <= 1.7.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityforsgren Video Embedder
- CVE-2025-31459WordPress Login Alert plugin <= 0.2.1 - CSRF to Stored XSS vulnerabilityPasqualePuzio Login Alert
- CVE-2025-31460WordPress OmniLeads Scripts and Tags Manager plugin <= 1.3 - CSRF to Stored XSS vulnerabilitydanielmuldernl OmniLeads Scripts and Tags Manager
- CVE-2025-31466WordPress Duplicate Page and Post plugin <= 1.0 - SQL Injection VulnerabilityFalcon Solutions Duplicate Page and Post
- CVE-2025-2815Administrator Z <= 2025.03.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Updatequyle91 Administrator Z
- CVE-2025-31099WordPress Slider by BestWebSoft plugin <= 1.1.0 - SQL Injection Vulnerabilitybestweblayout Slider by BestWebSoft
- CVE-2025-31102WordPress Hostel plugin <= 1.1.5.5 - Reflected Cross Site Scripting (XSS) vulnerabilityBob Hostel
- CVE-2025-27932Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file deletion process of the USB storage KDDI HGW-BL1500HM
- CVE-2025-27718Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file upload process of the USB storage fiKDDI HGW-BL1500HM
- CVE-2025-2485Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletionglenwpcoder Drag and Drop Multiple File Upload for Contact…
- CVE-2025-2328Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File Deletionglenwpcoder Drag and Drop Multiple File Upload for Contact…
- CVE-2025-24381Dell Unity, version(s) 5.4 and prior, contain(s) an URL Redirection to Untrusted Site ('Open Redirect') vulnerability.Dell Unity
- CVE-2025-24386Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2025-24377Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2025-24378Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2025-24379Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2025-24380Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2024-13939String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret stringFRACTAL String::Compare::ConstantTime
- CVE-2025-23383Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2025-24385Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2024-49601Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2025-24382Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2024-49563Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2024-49564Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2024-49565Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2025-1860Data::Entropy for Perl uses insecure rand() function for cryptographic functionsZEFRAM Data::Entropy
- CVE-2024-48615Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchiv
- CVE-2024-57083A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Deniredoc
- CVE-2024-58130In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responMISP
- CVE-2025-28220Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash
- CVE-2025-28221Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the set_local_time function, which allows remote attackers to cause web serve
Medium, low and unrated 100
- CVE-2024-51477IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2024-7577IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2024-43186IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2025-2782WatchGuard Terminal Services Agent Local Privilege Escalation via Non-Standard Installation DirectoryWatchGuard SSO Terminal Services Agent
- CVE-2025-2781WatchGuard Mobile VPN with SSL Local Privilege Escalation via Non-Standard Installation DirectoryWatchGuard Mobile VPN with SSL Client
- CVE-2024-6875Infinispan: infinispan: rest compare api has buffer leakinfinispan · Red Hat Data Grid +2
- CVE-2025-2927ESAFENET CDG getFileTypeList.jsp sql injectionESAFENET CDG
- CVE-2025-2926HDF5 H5Ocache.c H5O__cache_chk_serialize null pointer dereferenceHDF5
- CVE-2025-2925HDF5 H5MM.c H5MM_realloc double freeHDF5
- CVE-2025-2924HDF5 H5HLcache.c H5HL__fl_deserialize heap-based overflowHDF5
- CVE-2025-2923HDF5 H5Fint.c H5F_addr_encode_len heap-based overflowHDF5
- CVE-2025-2922Netis WF-2404 BusyBox Shell cleartext storageNetis WF-2404
- CVE-2025-31162fig2dev float point exceptionxfig fig2dev
- CVE-2025-31163fig2dev segmentation faultxfig fig2dev
- CVE-2025-31164fig2dev heap-buffer overflowxfig fig2dev
- CVE-2025-2921Netis WF-2404 passwd default passwordNetis WF-2404
- CVE-2025-2920Netis WF-2404 passwd weak hashNetis WF-2404
- CVE-2025-2917ChestnutCMS read readFile path traversalChestnutCMS
- CVE-2025-2916Aishida Call Center System amr2mp3 command injectionAishida Call Center System
- CVE-2025-2915HDF5 H5Faccum.c H5F__accum_free heap-based overflowHDF5
- CVE-2025-2914HDF5 H5FScache.c H5FS__sinfo_Srialize_Sct_cb heap-based overflowHDF5
- CVE-2025-2913HDF5 H5FL.c H5FL__blk_gc_list use after freeHDF5
- CVE-2025-2912HDF5 H5Omessage.c H5O_msg_flush heap-based overflowHDF5
- CVE-2025-2713Improper File Permission Handling in Google gVisor runscGoogle gVisor
- CVE-2025-31010WordPress SimplyRETS Real Estate IDX plugin <= 3.0.5 - CSRF to Multiple Admin Actions vulnerabilityReichertBrothers SimplyRETS Real Estate IDX
- CVE-2025-30371Metabase vulnerable to circumvention of local link access protection in GeoJson endpointmetabase
- CVE-2024-39311Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interactionpublify · publify_core
- CVE-2025-2877Event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in edaansible-rulebook · Red Hat Ansible Automation Platform 2… +1
- CVE-2025-2865Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCUArteche saTECH BCU
- CVE-2025-2864Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCUArteche saTECH BCU
- CVE-2025-2863Cross-site request forgery (CSRF) vulnerability in saTECH BCUArteche saTECH BCU
- CVE-2025-0986IBM PowerVM Hypervisor data manipulationIBM PowerVM Hypervisor
- CVE-2025-2862Weak Encoding for Password vulnerability in saTECH BCUArteche saTECH BCU
- CVE-2025-2861Cleartext Transmission of Sensitive Information vulnerability in saTECH BCUArteche saTECH BCU
- CVE-2025-2860Exposure of Sensitive Information vulnerability in saTECH BCUArteche saTECH BCU
- CVE-2025-2859Improper Authentication vulnerability in saTECH BCUArteche saTECH BCU
- CVE-2025-2911Improper Restriction of Excessive Authentication Attempts vulnerability in MeetMe productsFermax MeetMe
- CVE-2025-2910User enumeration vulnerability in MeetMe productsFermax MeetMe
- CVE-2025-2909Lack of encryption vulnerability in DuoxMeFermax DuoxMe iOS application
- CVE-2025-31433WordPress Magic Embeds plugin <= 3.1.2 - Cross Site Scripting (XSS) VulnerabilityMiguel Sirvent Magic Embeds
- CVE-2025-31434WordPress FormLift for Infusionsoft Web Forms plugin <= 7.5.19 - Cross Site Scripting (XSS) VulnerabilityAdrian Tobey FormLift for Infusionsoft Web Forms
- CVE-2025-31437WordPress WP-OGP plugin <= 1.0.5 - Cross Site Scripting (XSS) VulnerabilityDavid Miller WP-OGP
- CVE-2025-31438WordPress WP Supersized plugin <= 3.1.6 - Cross Site Request Forgery (CSRF) VulnerabilityBenoit De Boeck WP Supersized
- CVE-2025-31439WordPress Browser Caching with .htaccess 1.2.1 - Cross Site Request Forgery (CSRF) Vulnerabilitytobias_.MerZ Browser Caching with .htaccess
- CVE-2025-31447WordPress NertWorks All in One Social Share Tools plugin <=1.26 - Cross Site Request Forgery (CSRF) VulnerabilityNertWorks All in One Social Share Tools
- CVE-2025-31448WordPress Simple Trackback Disabler plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerabilitymisteraon Simple Trackback Disabler
- CVE-2025-31450WordPress Toggle Box plugin <= 1.6 - Cross Site Scripting (XSS) Vulnerabilityphantom.omaga Toggle Box
- CVE-2025-31451WordPress wBounce plugin <= 1.8.1 - Cross Site Scripting (XSS) Vulnerabilitykevinweber wBounce
- CVE-2025-31452WordPress WP Ultimate Search plugin <= 2.0.3 - Cross Site Scripting (XSS) VulnerabilityMindshare Labs WP Ultimate Search
- CVE-2025-31453WordPress YouTube SimpleGallery plugin <= 2.0.6 - Cross Site Scripting (XSS) VulnerabilityStian Andreassen YouTube SimpleGallery
- CVE-2025-31456WordPress Ultimate Security Checker plugin <= 4.2 - Cross Site Request Forgery (CSRF) to Security Rescan vulnerabilitybsndev Ultimate Security Checker
- CVE-2025-31457WordPress LWS SMS plugin <= 2.4.1 - Cross Site Request Forgery (CSRF) VulnerabilityAurélien LWS LWS SMS
- CVE-2025-31463WordPress TGG WP Optimizer plugin <= 1.25 - Cross Site Scripting (XSS) Vulnerabilitypreetindersodhi TGG WP Optimizer
- CVE-2025-31464WordPress Text Selection Color plugin <= 1.6 - Cross Site Scripting (XSS) VulnerabilityNazmur Rahman Text Selection Color
- CVE-2025-31465WordPress Better Section Navigation Widget plugin <= 1.6.1 - Cross Site Scripting (XSS) Vulnerabilitycornershop Better Section Navigation Widget
- CVE-2025-31469WordPress Clear Sucuri Cache plugin <= 1.4 - Broken Access Control Vulnerabilitywebrangers Clear Sucuri Cache
- CVE-2025-31470WordPress Page Takeover plugin <= 1.1.6 - Cross Site Scripting (XSS) VulnerabilityFancyThemes Page Takeover
- CVE-2025-31471WordPress Duplicate Page and Post plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityFalcon Solutions Duplicate Page and Post
- CVE-2025-31472WordPress Flatty plugin <= 2.0.0 - Cross Site Scripting (XSS) VulnerabilityMichele Marri Flatty
- CVE-2025-31473WordPress WP Database Optimizer plugin <= 1.2.1.3 - Cross Site Scripting (XSS) Vulnerabilitymatthewprice1178 WP Database Optimizer
- CVE-2025-31474WordPress WP Database Optimizer plugin <= 1.2.1.3 - Cross Site Request Forgery (CSRF) Vulnerabilitymatthewprice1178 WP Database Optimizer
- CVE-2025-2870Reflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing SystemClinic Queuing System
- CVE-2025-2869Reflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing SystemClinic Queuing System
- CVE-2025-2868Reflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing SystemClinic Queuing System
- CVE-2021-24008An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.Fortinet FortiDDoS · Fortinet FortiNDR +1
- CVE-2024-10307Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2024-12619Insufficient Granularity of Access Control in GitLabGitLab
- CVE-2025-31073WordPress Unlimited plugin <= 1.45 - Cross Site Scripting (XSS) Vulnerabilitybensibley Unlimited
- CVE-2025-31075WordPress MicroPayments plugin <= 2.9.29 - Cross Site Scripting (XSS) vulnerabilityvideowhisper MicroPayments
- CVE-2025-31076WordPress WP Compress for MainWP plugin <= 6.30.03 - Server Side Request Forgery (SSRF) vulnerabilityWP Compress for MainWP
- CVE-2025-31077WordPress Ultimate Blocks plugin <= 3.2.7 - Cross Site Scripting (XSS) vulnerabilityUltimate Blocks
- CVE-2025-31079WordPress Usermaven plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityUsermaven
- CVE-2025-31083WordPress Leaky Paywall plugin <= 4.21.7 - Cross Site Scripting (XSS) VulnerabilityZEEN101 Leaky Paywall
- CVE-2025-31088WordPress Paid Member Subscriptions plugin <= 2.14.3 - Cross Site Scripting (XSS) VulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2025-31090WordPress Dropdown Multisite selector plugin < 0.9.4 - Cross Site Scripting (XSS) Vulnerabilityalordiel Dropdown Multisite selector
- CVE-2025-31093WordPress RPS Include Content plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerabilityredpixelstudios RPS Include Content
- CVE-2025-31094WordPress WP Posts Carousel plugin <= 1.3.8 - Cross Site Scripting (XSS) Vulnerabilityteastudio.pl WP Posts Carousel
- CVE-2025-31096WordPress PostX plugin <= 4.1.25 - Cross Site Scripting (XSS) VulnerabilityWPXPO PostX
- CVE-2025-27001WordPress Shipmondo – A complete shipping solution for WooCommerce plugin <= 5.0.3 - Authenticated Arbitrary WordPress Option Disclosure vulnerabilityShipmondo – A complete shipping solution for WooCommerce
- CVE-2019-16149An Improper Neutralization of Input During Web Page Generation in FortiClientEMS version 6.2.0 may allow a remote attacker to execute unauthFortinet FortiClientEMS
- CVE-2025-1705tagDiv Composer <= 5.3 - Cross-Site Request Forgery to Stored Cross-Site ScriptingtagDiv Composer
- CVE-2025-27726Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file download process of the USB storage KDDI HGW-BL1500HM
- CVE-2025-27716Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file/folder listing process of the USB stKDDI HGW-BL1500HM
- CVE-2025-27574Cross-site scripting vulnerability exists in the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier.KDDI HGW-BL1500HM
- CVE-2025-27567Cross-site scripting vulnerability exists in the NickName registration screen of HGW-BL1500HM Ver 002.002.003 and earlier.KDDI HGW-BL1500HM
- CVE-2025-2074Advanced Google reCAPTCHA <= 1.29 - Authenticated (Subscriber+) Limited SQL Injection via 'sSearch' Parameterwebfactory Advanced Google reCAPTCHA
- CVE-2025-2578Booking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path Disclosureameliabooking Booking for Appointments and Events Calendar…
- CVE-2025-1762Event Tickets with Ticket Scanner < 2.5.4 - Arbitrary Tickets Deletion via CSRFEvent Tickets with Ticket Scanner
- CVE-2025-2027A double free vulnerability has been identified in the ASUS System Analysis service.ASUS ASCI
- CVE-2025-2804tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'tagDiv Composer
- CVE-2025-2894Unitree Go1 Robot Dog Backdoor Control ChannelUnitree Go1
- CVE-2024-58128In MISP before 2.4.193, menu_custom_right_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin MISP
- CVE-2024-58129In MISP before 2.4.193, menu_custom_right_link_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with aMISP
- CVE-2025-28092ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.shopxo/shopxo
- CVE-2025-28093ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.shopxo/shopxo
- CVE-2025-28094shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.shopxo/shopxo
- CVE-2025-28096OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers.
- CVE-2025-28097OneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers.
- CVE-2025-28254Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensileantime/leantime
- CVE-2025-31335The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely Shibboleth OpenSAML C++ library