# CVEs published 2025-03-28

172 CVEs were published on March 28, 2025: 17 critical, 55 high. Days are UTC.

- [CVE-2024-51477](https://cve.now/CVE-2024-51477.md): IBM InfoSphere Information Server information disclosure (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2024-7577](https://cve.now/CVE-2024-7577.md): IBM InfoSphere Information Server information disclosure (CVSS 4.4, IBM InfoSphere Information Server)
- [CVE-2024-43186](https://cve.now/CVE-2024-43186.md): IBM InfoSphere Information Server information disclosure (CVSS 5.3, IBM InfoSphere Information Server)
- [CVE-2025-2782](https://cve.now/CVE-2025-2782.md): WatchGuard Terminal Services Agent Local Privilege Escalation via Non-Standard Installation Directory (CVSS 6.3, WatchGuard SSO Terminal Services Agent)
- [CVE-2025-2781](https://cve.now/CVE-2025-2781.md): WatchGuard Mobile VPN with SSL Local Privilege Escalation via Non-Standard Installation Directory (CVSS 6.3, WatchGuard Mobile VPN with SSL Client)
- [CVE-2024-6875](https://cve.now/CVE-2024-6875.md): Infinispan: infinispan: rest compare api has buffer leak (CVSS 6.5, infinispan · Red Hat Data Grid +2)
- [CVE-2025-2927](https://cve.now/CVE-2025-2927.md): ESAFENET CDG getFileTypeList.jsp sql injection (CVSS 6.9, ESAFENET CDG)
- [CVE-2025-2926](https://cve.now/CVE-2025-2926.md): HDF5 H5Ocache.c H5O\_\_cache\_chk\_serialize null pointer dereference (CVSS 4.8, HDF5)
- [CVE-2025-2925](https://cve.now/CVE-2025-2925.md): HDF5 H5MM.c H5MM\_realloc double free (CVSS 4.8, HDF5)
- [CVE-2025-2924](https://cve.now/CVE-2025-2924.md): HDF5 H5HLcache.c H5HL\_\_fl\_deserialize heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-2923](https://cve.now/CVE-2025-2923.md): HDF5 H5Fint.c H5F\_addr\_encode\_len heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-2922](https://cve.now/CVE-2025-2922.md): Netis WF-2404 BusyBox Shell cleartext storage (CVSS 1.0, Netis WF-2404)
- [CVE-2025-31162](https://cve.now/CVE-2025-31162.md): fig2dev float point exception (CVSS 6.6, xfig fig2dev)
- [CVE-2025-31163](https://cve.now/CVE-2025-31163.md): fig2dev segmentation fault (CVSS 6.6, xfig fig2dev)
- [CVE-2025-31164](https://cve.now/CVE-2025-31164.md): fig2dev heap-buffer overflow (CVSS 6.6, xfig fig2dev)
- [CVE-2025-2921](https://cve.now/CVE-2025-2921.md): Netis WF-2404 passwd default password (CVSS 5.4, Netis WF-2404)
- [CVE-2025-2920](https://cve.now/CVE-2025-2920.md): Netis WF-2404 passwd weak hash (CVSS 1.0, Netis WF-2404)
- [CVE-2025-2919](https://cve.now/CVE-2025-2919.md): Netis WF-2404 UART hardware allows activation of test or debug logic at runtime (CVSS 7.0, Netis WF-2404)
- [CVE-2025-2917](https://cve.now/CVE-2025-2917.md): ChestnutCMS read readFile path traversal (CVSS 5.3, ChestnutCMS)
- [CVE-2025-2916](https://cve.now/CVE-2025-2916.md): Aishida Call Center System amr2mp3 command injection (CVSS 5.3, Aishida Call Center System)
- [CVE-2025-2915](https://cve.now/CVE-2025-2915.md): HDF5 H5Faccum.c H5F\_\_accum\_free heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-2914](https://cve.now/CVE-2025-2914.md): HDF5 H5FScache.c H5FS\_\_sinfo\_Srialize\_Sct\_cb heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-2913](https://cve.now/CVE-2025-2913.md): HDF5 H5FL.c H5FL\_\_blk\_gc\_list use after free (CVSS 4.8, HDF5)
- [CVE-2025-2912](https://cve.now/CVE-2025-2912.md): HDF5 H5Omessage.c H5O\_msg\_flush heap-based overflow (CVSS 4.8, HDF5)
- [CVE-2025-2713](https://cve.now/CVE-2025-2713.md): Improper File Permission Handling in Google gVisor runsc (CVSS 6.8, Google gVisor)
- [CVE-2025-31010](https://cve.now/CVE-2025-31010.md): WordPress SimplyRETS Real Estate IDX plugin \<= 3.0.5 - CSRF to Multiple Admin Actions vulnerability (CVSS 4.3, ReichertBrothers SimplyRETS Real Estate IDX)
- [CVE-2025-22767](https://cve.now/CVE-2025-22767.md): WordPress GlobalPayments WooCommerce Plugin \<= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Global Payments GlobalPayments WooCommerce)
- [CVE-2025-22575](https://cve.now/CVE-2025-22575.md): WordPress SUPER RESPONSIVE SLIDER Plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, extendyourweb SUPER RESPONSIVE SLIDER)
- [CVE-2025-22566](https://cve.now/CVE-2025-22566.md): WordPress ULTIMATE VIDEO GALLERY Plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, extendyourweb ULTIMATE VIDEO GALLERY)
- [CVE-2025-22526](https://cve.now/CVE-2025-22526.md): WordPress PHP/MySQL CPU performance statistics Plugin \<= 1.2.1 - PHP Object Injection vulnerability (CVSS 9.8, mywebtonet PHP/MySQL CPU performance statistics)
- [CVE-2025-22523](https://cve.now/CVE-2025-22523.md): WordPress Schedule Plugin \<= 1.0.0 - SQL Injection vulnerability (CVSS 9.3, scheduler Schedule)
- [CVE-2025-22501](https://cve.now/CVE-2025-22501.md): WordPress Improve My City plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Improve My City)
- [CVE-2025-22360](https://cve.now/CVE-2025-22360.md): WordPress WP Azure offload plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, promact WP Azure offload)
- [CVE-2025-22356](https://cve.now/CVE-2025-22356.md): WordPress Stencies plugin \<= 0.58 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Stencies)
- [CVE-2024-54362](https://cve.now/CVE-2024-54362.md): WordPress GetShop ecommerce plugin \<= 1.3 - Path Traversal vulnerability (CVSS 8.1, boggibill GetShop ecommerce)
- [CVE-2024-54291](https://cve.now/CVE-2024-54291.md): WordPress PluginPass plugin \<= 0.9.10 - Arbitrary File Download/Delete vulnerability (CVSS 8.6, labs64 PluginPass)
- [CVE-2024-51624](https://cve.now/CVE-2024-51624.md): WordPress Já-Já Pagamentos for WooCommerce plugin \<= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jajapagamentos Já-Já Pagamentos for WooCommerce)
- [CVE-2025-30211](https://cve.now/CVE-2025-30211.md): KEX init error results with excessive memory usage (CVSS 7.5, erlang otp)
- [CVE-2025-30372](https://cve.now/CVE-2025-30372.md): Emlog Pro contains an SQL injection vulnerability. (CVSS 7.7, emlog)
- [CVE-2025-30371](https://cve.now/CVE-2025-30371.md): Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint (CVSS 2.1, metabase)
- [CVE-2025-29928](https://cve.now/CVE-2025-29928.md): authentik's deletion of sessions did not revoke sessions when using database session storage (CVSS 8.0, goauthentik authentik)
- [CVE-2024-39311](https://cve.now/CVE-2024-39311.md): Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction (CVSS 1.8, publify · publify\_core)
- [CVE-2025-2877](https://cve.now/CVE-2025-2877.md): Event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in eda (CVSS 6.5, ansible-rulebook · Red Hat Ansible Automation Platform 2… +1)
- [CVE-2025-1781](https://cve.now/CVE-2025-1781.md): There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce ser (CVSS 8.4, W3C CSS Validator)
- [CVE-2025-2865](https://cve.now/CVE-2025-2865.md): Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU (CVSS 2.4, Arteche saTECH BCU)
- [CVE-2025-2864](https://cve.now/CVE-2025-2864.md): Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU (CVSS 2.0, Arteche saTECH BCU)
- [CVE-2025-2863](https://cve.now/CVE-2025-2863.md): Cross-site request forgery (CSRF) vulnerability in saTECH BCU (CVSS 5.7, Arteche saTECH BCU)
- [CVE-2025-0986](https://cve.now/CVE-2025-0986.md): IBM PowerVM Hypervisor data manipulation (CVSS 4.5, IBM PowerVM Hypervisor)
- [CVE-2025-2862](https://cve.now/CVE-2025-2862.md): Weak Encoding for Password vulnerability in saTECH BCU (CVSS 6.9, Arteche saTECH BCU)
- [CVE-2025-2861](https://cve.now/CVE-2025-2861.md): Cleartext Transmission of Sensitive Information vulnerability in saTECH BCU (CVSS 6.9, Arteche saTECH BCU)
- [CVE-2025-2860](https://cve.now/CVE-2025-2860.md): Exposure of Sensitive Information vulnerability in saTECH BCU (CVSS 6.9, Arteche saTECH BCU)
- [CVE-2025-2859](https://cve.now/CVE-2025-2859.md): Improper Authentication vulnerability in saTECH BCU (CVSS 6.9, Arteche saTECH BCU)
- [CVE-2025-2858](https://cve.now/CVE-2025-2858.md): Privilege escalation vulnerability in saTECH BCU (CVSS 8.5, Arteche saTECH BCU)
- [CVE-2025-2911](https://cve.now/CVE-2025-2911.md): Improper Restriction of Excessive Authentication Attempts vulnerability in MeetMe products (CVSS 5.3, Fermax MeetMe)
- [CVE-2024-7407](https://cve.now/CVE-2024-7407.md): Weak password encoding in Streamsoft Prestiż (CVSS 8.2, Streamsoft Prestiż)
- [CVE-2024-11504](https://cve.now/CVE-2024-11504.md): SQL Injection in Streamsoft Prestiż (CVSS 8.6, Streamsoft Prestiż)
- [CVE-2025-2910](https://cve.now/CVE-2025-2910.md): User enumeration vulnerability in MeetMe products (CVSS 6.9, Fermax MeetMe)
- [CVE-2025-2909](https://cve.now/CVE-2025-2909.md): Lack of encryption vulnerability in DuoxMe (CVSS 6.9, Fermax DuoxMe iOS application)
- [CVE-2025-2908](https://cve.now/CVE-2025-2908.md): Insufficiently Protected Credentials vulnerability in MeetMe products (CVSS 8.5, Fermax MeetMe)
- [CVE-2025-31432](https://cve.now/CVE-2025-31432.md): WordPress Pop-Up Chop Chop plugin \<= 2.1.7 - Local File Inclusion Vulnerability (CVSS 7.5, Pop-Up Chop Chop)
- [CVE-2025-31433](https://cve.now/CVE-2025-31433.md): WordPress Magic Embeds plugin \<= 3.1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Miguel Sirvent Magic Embeds)
- [CVE-2025-31434](https://cve.now/CVE-2025-31434.md): WordPress FormLift for Infusionsoft Web Forms plugin \<= 7.5.19 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Adrian Tobey FormLift for Infusionsoft Web Forms)
- [CVE-2025-31435](https://cve.now/CVE-2025-31435.md): WordPress Microblog Poster plugin \<= 2.1.6 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, Efficient Scripts Microblog Poster)
- [CVE-2025-31437](https://cve.now/CVE-2025-31437.md): WordPress WP-OGP plugin \<= 1.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, David Miller WP-OGP)
- [CVE-2025-31438](https://cve.now/CVE-2025-31438.md): WordPress WP Supersized plugin \<= 3.1.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Benoit De Boeck WP Supersized)
- [CVE-2025-31439](https://cve.now/CVE-2025-31439.md): WordPress Browser Caching with .htaccess 1.2.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, tobias\_.MerZ Browser Caching with .htaccess)
- [CVE-2025-31440](https://cve.now/CVE-2025-31440.md): WordPress Terms of Use plugin \<= 2.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, Strategy11 Team Terms of Use)
- [CVE-2025-31443](https://cve.now/CVE-2025-31443.md): WordPress KK I Like It plugin \<= 1.7.5.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Krzysztof Furtak KK I Like It)
- [CVE-2025-31444](https://cve.now/CVE-2025-31444.md): WordPress ShowTime Slideshow plugin \<= 1.6 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, youtag ShowTime Slideshow)
- [CVE-2025-31447](https://cve.now/CVE-2025-31447.md): WordPress NertWorks All in One Social Share Tools plugin \<=1.26 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, NertWorks All in One Social Share Tools)
- [CVE-2025-31448](https://cve.now/CVE-2025-31448.md): WordPress Simple Trackback Disabler plugin \<= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, misteraon Simple Trackback Disabler)
- [CVE-2025-31449](https://cve.now/CVE-2025-31449.md): WordPress The Visitor Counter plugin \<= 1.4.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, EricH The Visitor Counter)
- [CVE-2025-31450](https://cve.now/CVE-2025-31450.md): WordPress Toggle Box plugin \<= 1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, phantom.omaga Toggle Box)
- [CVE-2025-31451](https://cve.now/CVE-2025-31451.md): WordPress wBounce plugin \<= 1.8.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, kevinweber wBounce)
- [CVE-2025-31452](https://cve.now/CVE-2025-31452.md): WordPress WP Ultimate Search plugin \<= 2.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Mindshare Labs WP Ultimate Search)
- [CVE-2025-31453](https://cve.now/CVE-2025-31453.md): WordPress YouTube SimpleGallery plugin \<= 2.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Stian Andreassen YouTube SimpleGallery)
- [CVE-2025-31456](https://cve.now/CVE-2025-31456.md): WordPress Ultimate Security Checker plugin \<= 4.2 - Cross Site Request Forgery (CSRF) to Security Rescan vulnerability (CVSS 4.3, bsndev Ultimate Security Checker)
- [CVE-2025-31457](https://cve.now/CVE-2025-31457.md): WordPress LWS SMS plugin \<= 2.4.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, Aurélien LWS LWS SMS)
- [CVE-2025-31458](https://cve.now/CVE-2025-31458.md): WordPress Video Embedder plugin \<= 1.7.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, forsgren Video Embedder)
- [CVE-2025-31459](https://cve.now/CVE-2025-31459.md): WordPress Login Alert plugin \<= 0.2.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, PasqualePuzio Login Alert)
- [CVE-2025-31460](https://cve.now/CVE-2025-31460.md): WordPress OmniLeads Scripts and Tags Manager plugin \<= 1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, danielmuldernl OmniLeads Scripts and Tags Manager)
- [CVE-2025-31463](https://cve.now/CVE-2025-31463.md): WordPress TGG WP Optimizer plugin \<= 1.25 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, preetindersodhi TGG WP Optimizer)
- [CVE-2025-31464](https://cve.now/CVE-2025-31464.md): WordPress Text Selection Color plugin \<= 1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Nazmur Rahman Text Selection Color)
- [CVE-2025-31465](https://cve.now/CVE-2025-31465.md): WordPress Better Section Navigation Widget plugin \<= 1.6.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, cornershop Better Section Navigation Widget)
- [CVE-2025-31466](https://cve.now/CVE-2025-31466.md): WordPress Duplicate Page and Post plugin \<= 1.0 - SQL Injection Vulnerability (CVSS 8.5, Falcon Solutions Duplicate Page and Post)
- [CVE-2025-31469](https://cve.now/CVE-2025-31469.md): WordPress Clear Sucuri Cache plugin \<= 1.4 - Broken Access Control Vulnerability (CVSS 5.3, webrangers Clear Sucuri Cache)
- [CVE-2025-31470](https://cve.now/CVE-2025-31470.md): WordPress Page Takeover plugin \<= 1.1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, FancyThemes Page Takeover)
- [CVE-2025-31471](https://cve.now/CVE-2025-31471.md): WordPress Duplicate Page and Post plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Falcon Solutions Duplicate Page and Post)
- [CVE-2025-31472](https://cve.now/CVE-2025-31472.md): WordPress Flatty plugin \<= 2.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Michele Marri Flatty)
- [CVE-2025-31473](https://cve.now/CVE-2025-31473.md): WordPress WP Database Optimizer plugin \<= 1.2.1.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, matthewprice1178 WP Database Optimizer)
- [CVE-2025-31474](https://cve.now/CVE-2025-31474.md): WordPress WP Database Optimizer plugin \<= 1.2.1.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, matthewprice1178 WP Database Optimizer)
- [CVE-2025-2815](https://cve.now/CVE-2025-2815.md): Administrator Z \<= 2025.03.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, quyle91 Administrator Z)
- [CVE-2025-2870](https://cve.now/CVE-2025-2870.md): Reflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing System (CVSS 4.8, Clinic Queuing System)
- [CVE-2025-2869](https://cve.now/CVE-2025-2869.md): Reflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing System (CVSS 4.8, Clinic Queuing System)
- [CVE-2025-2868](https://cve.now/CVE-2025-2868.md): Reflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing System (CVSS 4.8, Clinic Queuing System)
- [CVE-2021-24008](https://cve.now/CVE-2021-24008.md): An exposure of sensitive system information to an unauthorized control sphere vulnerability \[CWE-497\] in FortiDDoS version 5.4.0, version 5. (CVSS 5.0, Fortinet FortiDDoS · Fortinet FortiNDR +1)
- [CVE-2024-10307](https://cve.now/CVE-2024-10307.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-12619](https://cve.now/CVE-2024-12619.md): Insufficient Granularity of Access Control in GitLab (CVSS 5.2, GitLab)
- [CVE-2025-31073](https://cve.now/CVE-2025-31073.md): WordPress Unlimited plugin \<= 1.45 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, bensibley Unlimited)
- [CVE-2025-31075](https://cve.now/CVE-2025-31075.md): WordPress MicroPayments plugin \<= 2.9.29 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, videowhisper MicroPayments)
- [CVE-2025-31076](https://cve.now/CVE-2025-31076.md): WordPress WP Compress for MainWP plugin \<= 6.30.03 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, WP Compress for MainWP)
- [CVE-2025-31077](https://cve.now/CVE-2025-31077.md): WordPress Ultimate Blocks plugin \<= 3.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ultimate Blocks)
- [CVE-2025-31079](https://cve.now/CVE-2025-31079.md): WordPress Usermaven plugin \<= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Usermaven)
- [CVE-2025-31083](https://cve.now/CVE-2025-31083.md): WordPress Leaky Paywall plugin \<= 4.21.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, ZEEN101 Leaky Paywall)
- [CVE-2025-31088](https://cve.now/CVE-2025-31088.md): WordPress Paid Member Subscriptions plugin \<= 2.14.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Cozmoslabs Paid Member Subscriptions)
- [CVE-2025-31090](https://cve.now/CVE-2025-31090.md): WordPress Dropdown Multisite selector plugin \< 0.9.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, alordiel Dropdown Multisite selector)
- [CVE-2025-31093](https://cve.now/CVE-2025-31093.md): WordPress RPS Include Content plugin \<= 1.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, redpixelstudios RPS Include Content)
- [CVE-2025-31094](https://cve.now/CVE-2025-31094.md): WordPress WP Posts Carousel plugin \<= 1.3.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, teastudio.pl WP Posts Carousel)
- [CVE-2025-31096](https://cve.now/CVE-2025-31096.md): WordPress PostX plugin \<= 4.1.25 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPXPO PostX)
- [CVE-2025-31099](https://cve.now/CVE-2025-31099.md): WordPress Slider by BestWebSoft plugin \<= 1.1.0 - SQL Injection Vulnerability (CVSS 7.6, bestweblayout Slider by BestWebSoft)
- [CVE-2025-31102](https://cve.now/CVE-2025-31102.md): WordPress Hostel plugin \<= 1.1.5.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bob Hostel)
- [CVE-2025-27001](https://cve.now/CVE-2025-27001.md): WordPress Shipmondo – A complete shipping solution for WooCommerce plugin \<= 5.0.3 - Authenticated Arbitrary WordPress Option Disclosure vulnerability (CVSS 6.5, Shipmondo – A complete shipping solution for WooCommerce)
- [CVE-2019-16149](https://cve.now/CVE-2019-16149.md): An Improper Neutralization of Input During Web Page Generation in FortiClientEMS version 6.2.0 may allow a remote attacker to execute unauth (CVSS 5.4, Fortinet FortiClientEMS)
- [CVE-2025-1705](https://cve.now/CVE-2025-1705.md): tagDiv Composer \<= 5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, tagDiv Composer)
- [CVE-2025-27932](https://cve.now/CVE-2025-27932.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file deletion process of the USB storage (CVSS 8.1, KDDI HGW-BL1500HM)
- [CVE-2025-27726](https://cve.now/CVE-2025-27726.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file download process of the USB storage (CVSS 2.1, KDDI HGW-BL1500HM)
- [CVE-2025-27718](https://cve.now/CVE-2025-27718.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file upload process of the USB storage fi (CVSS 8.8, KDDI HGW-BL1500HM)
- [CVE-2025-27716](https://cve.now/CVE-2025-27716.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file/folder listing process of the USB st (CVSS 6.5, KDDI HGW-BL1500HM)
- [CVE-2025-27574](https://cve.now/CVE-2025-27574.md): Cross-site scripting vulnerability exists in the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. (CVSS 3.6, KDDI HGW-BL1500HM)
- [CVE-2025-27567](https://cve.now/CVE-2025-27567.md): Cross-site scripting vulnerability exists in the NickName registration screen of HGW-BL1500HM Ver 002.002.003 and earlier. (CVSS 5.4, KDDI HGW-BL1500HM)
- [CVE-2025-2074](https://cve.now/CVE-2025-2074.md): Advanced Google reCAPTCHA \<= 1.29 - Authenticated (Subscriber+) Limited SQL Injection via 'sSearch' Parameter (CVSS 5.3, webfactory Advanced Google reCAPTCHA)
- [CVE-2025-2578](https://cve.now/CVE-2025-2578.md): Booking for Appointments and Events Calendar – Amelia \<= 1.2.19 - Unauthenticated Full Path Disclosure (CVSS 5.3, ameliabooking Booking for Appointments and Events Calendar…)
- [CVE-2025-2485](https://cve.now/CVE-2025-2485.md): Drag and Drop Multiple File Upload for Contact Form 7 \<= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion (CVSS 7.5, glenwpcoder Drag and Drop Multiple File Upload for Contact…)
- [CVE-2025-2328](https://cve.now/CVE-2025-2328.md): Drag and Drop Multiple File Upload for Contact Form 7 \<= 1.3.8.7 - Unauthenticated Arbitrary File Deletion (CVSS 8.8, glenwpcoder Drag and Drop Multiple File Upload for Contact…)
- [CVE-2025-1762](https://cve.now/CVE-2025-1762.md): Event Tickets with Ticket Scanner \< 2.5.4 - Arbitrary Tickets Deletion via CSRF (CVSS 4.3, Event Tickets with Ticket Scanner)
- [CVE-2025-2027](https://cve.now/CVE-2025-2027.md): A double free vulnerability has been identified in the ASUS System Analysis service. (CVSS 5.9, ASUS ASCI)
- [CVE-2025-2804](https://cve.now/CVE-2025-2804.md): tagDiv Composer \<= 5.3 - Reflected Cross-Site Scripting via 'account\_id' and 'account\_username' (CVSS 6.1, tagDiv Composer)
- [CVE-2025-2294](https://cve.now/CVE-2025-2294.md): Kubio AI Page Builder \<= 2.5.1 - Unauthenticated Local File Inclusion (CVSS 9.8, extendthemes Kubio AI Page Builder)
- [CVE-2025-2894](https://cve.now/CVE-2025-2894.md): Unitree Go1 Robot Dog Backdoor Control Channel (CVSS 6.6, Unitree Go1)
- [CVE-2025-24381](https://cve.now/CVE-2025-24381.md): Dell Unity, version(s) 5.4 and prior, contain(s) an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. (CVSS 8.8, Dell Unity)
- [CVE-2025-24386](https://cve.now/CVE-2025-24386.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2025-24377](https://cve.now/CVE-2025-24377.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2025-24378](https://cve.now/CVE-2025-24378.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2025-24379](https://cve.now/CVE-2025-24379.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2025-24380](https://cve.now/CVE-2025-24380.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2024-13939](https://cve.now/CVE-2024-13939.md): String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string (CVSS 7.5, FRACTAL String::Compare::ConstantTime)
- [CVE-2025-23383](https://cve.now/CVE-2025-23383.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2025-24385](https://cve.now/CVE-2025-24385.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2024-49601](https://cve.now/CVE-2024-49601.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.3, Dell Unity)
- [CVE-2025-24382](https://cve.now/CVE-2025-24382.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.3, Dell Unity)
- [CVE-2025-22398](https://cve.now/CVE-2025-22398.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 9.8, Dell Unity)
- [CVE-2024-49563](https://cve.now/CVE-2024-49563.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2024-49564](https://cve.now/CVE-2024-49564.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2024-49565](https://cve.now/CVE-2024-49565.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2025-24383](https://cve.now/CVE-2025-24383.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 9.1, Dell Unity)
- [CVE-2025-1860](https://cve.now/CVE-2025-1860.md): Data::Entropy for Perl uses insecure rand() function for cryptographic functions (CVSS 7.7, ZEFRAM Data::Entropy)
- [CVE-2024-24292](https://cve.now/CVE-2024-24292.md): A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function in the aim.js compo (CVSS 9.8)
- [CVE-2024-38985](https://cve.now/CVE-2024-38985.md): janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/in (CVSS 9.8, depath · cool-path)
- [CVE-2024-38988](https://cve.now/CVE-2024-38988.md): alizeait unflatto \<= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js. (CVSS 9.8, @alizeait/unflatto)
- [CVE-2024-48615](https://cve.now/CVE-2024-48615.md): Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header\_pax\_extension at rchiv (CVSS 7.5)
- [CVE-2024-56975](https://cve.now/CVE-2024-56975.md): InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload\_file (CVSS 9.8)
- [CVE-2024-57083](https://cve.now/CVE-2024-57083.md): A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc \<= 2.2.0 allows attackers to cause a Deni (CVSS 7.5, redoc)
- [CVE-2024-58128](https://cve.now/CVE-2024-58128.md): In MISP before 2.4.193, menu\_custom\_right\_link parameters can be set via the UI (i.e., without using the CLI) and thus attackers with admin (CVSS 5.5, MISP)
- [CVE-2024-58129](https://cve.now/CVE-2024-58129.md): In MISP before 2.4.193, menu\_custom\_right\_link\_html parameters can be set via the UI (i.e., without using the CLI) and thus attackers with a (CVSS 5.5, MISP)
- [CVE-2024-58130](https://cve.now/CVE-2024-58130.md): In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON respon (CVSS 7.2, MISP)
- [CVE-2025-22953](https://cve.now/CVE-2025-22953.md): A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.57 (CVSS 9.8)
- [CVE-2025-25579](https://cve.now/CVE-2025-25579.md): TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. (CVSS 9.8)
- [CVE-2025-28087](https://cve.now/CVE-2025-28087.md): Sourcecodester Online Exam System 1.0 is vulnerable to SQL Injection via dash.php. (CVSS 9.8)
- [CVE-2025-28089](https://cve.now/CVE-2025-28089.md): maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function. (CVSS 9.1)
- [CVE-2025-28090](https://cve.now/CVE-2025-28090.md): maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature. (CVSS 9.1)
- [CVE-2025-28091](https://cve.now/CVE-2025-28091.md): maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article. (CVSS 9.1)
- [CVE-2025-28092](https://cve.now/CVE-2025-28092.md): ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function. (CVSS 6.3, shopxo/shopxo)
- [CVE-2025-28093](https://cve.now/CVE-2025-28093.md): ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings. (CVSS 6.3, shopxo/shopxo)
- [CVE-2025-28094](https://cve.now/CVE-2025-28094.md): shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places. (CVSS 6.5, shopxo/shopxo)
- [CVE-2025-28096](https://cve.now/CVE-2025-28096.md): OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers. (CVSS 5.4)
- [CVE-2025-28097](https://cve.now/CVE-2025-28097.md): OneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers. (CVSS 5.5)
- [CVE-2025-28219](https://cve.now/CVE-2025-28219.md): Netgear DC112A V1.0.0.64 has an OS command injection vulnerability in the usb\_adv.cgi, which allows remote attackers to execute arbitrary co (CVSS 9.8)
- [CVE-2025-28220](https://cve.now/CVE-2025-28220.md): Tenda W6\_S v1.0.0.4\_510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash (CVSS 7.5)
- [CVE-2025-28221](https://cve.now/CVE-2025-28221.md): Tenda W6\_S v1.0.0.4\_510 has a Buffer Overflow vulnerability in the set\_local\_time function, which allows remote attackers to cause web serve (CVSS 7.5)
- [CVE-2025-28254](https://cve.now/CVE-2025-28254.md): Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensi (CVSS 5.4, leantime/leantime)
- [CVE-2025-28256](https://cve.now/CVE-2025-28256.md): An issue in TOTOLINK A3100R V4.1.2cu.5247\_B20211129 allows a remote attacker to execute arbitrary code via the setWebWlanIdx of the file /li (CVSS 9.8)
- [CVE-2025-31335](https://cve.now/CVE-2025-31335.md): The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely (CVSS 4.0, Shibboleth OpenSAML C++ library)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.