CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- zframeworks zzzj1983 zz import_data_todb server-side request forgery5.3 Medium
- zframeworks zzzj1983 zz import_data_check server-side request forgery5.3 Medium
- zframeworks zzzj1983 zz improper authorization5.3 Medium
- zframeworks zzzj1983 zz File ZfileAction.java deleteLocalFile denial of service5.3 Medium
- google android, mediatek, inc. mt6781, mt6789, mt6835, mt6855, mt6878, mt6879, mt6886, mt6895, mt6897, mt6983, mt6985, mt6989, mt8370, mt8390 +1 moreIn da, there is a possible out of bounds read due to an integer overflow. This could lead to...6.5 Medium
- google android, mediatek, inc. mt6580, mt6739, mt6761, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6873, mt6877, mt6885, mt6893, mt8167, mt8167s, mt8175, mt8185, mt8195, mt8321, mt8362a, mt8365, mt8385, mt8395, mt8666, mt8667, mt8673, mt8675, mt8678, mt8765, mt8766, mt8768, mt8771, mt8775, mt8781, mt8786, mt8788, mt8789, mt8791t, mt8795t, mt8797, mt8798, mt8893 +1 moreIn V5 DA, there is a possible out of bounds read due to a missing bounds check. This could lead...4.6 Medium
- google android, linuxfoundation yocto, mediatek, inc. mt2737, mt6781, mt6789, mt6835, mt6855, mt6878, mt6879, mt6880, mt6886, mt6890, mt6895, mt6897, mt6980, mt6983, mt6985, mt6989, mt6990, mt8370, mt8390, mt8676, mt8678 +2 more +4 moreIn da, there is a possible out of bounds read due to a missing bounds check. This could lead to...4.1 Medium
- google android, linuxfoundation yocto, mediatek, inc. mt2737, mt6781, mt6789, mt6835, mt6855, mt6878, mt6879, mt6880, mt6886, mt6890, mt6895, mt6897, mt6980, mt6983, mt6985, mt6989, mt6990, mt8370, mt8390, mt8676, mt8678 +2 more +4 moreIn da, there is a possible out of bounds write due to a missing bounds check. This could lead to...6.8 Medium
- mediatek software development kit, mediatek, inc. mt6880, mt6890, mt6980, mt6990, mt7663, mt7902, mt7925, mt7927, mt7961, openwrt +2 moreIn Bluetooth Stack SW, there is a possible information disclosure due to a missing permission...6.5 Medium
- google android, mediatek, inc. mt2718, mt6879, mt6989, mt8196, mt8370, mt8390, mt8395, mt8673, mt8678 +1 moreIn apu, there is a possible out of bounds read due to a missing bounds check. This could lead to...5.5 Medium
- mediatek nr12a, nr13, nr15 +2 more +4 moreIn Modem, there is a possible system crash due to a missing bounds check. This could lead to...6.5 Medium
- mediatek software development kit, mediatek, inc. mt6890, mt7915, mt7916, mt7981, mt7986 +1 moreIn wlan AP FW, there is a possible out of bounds write due to improper input validation. This...9.8 Critical
- esafenet dsmESAFENET DSM examExportPDF command injection5.3 Medium
- esafenet cdgESAFENET CDG backupLogDetail.jsp sql injection5.3 Medium
- project team tmall demoMini-Tmall ProductMapper.java select sql injection5.3 Medium
- fitstats technologies athletemonitoringFITSTATS Technologies AthleteMonitoring login.php cross site scripting5.3 Medium
- esafenet cdgESAFENET CDG ClientSortLog.jsp sql injection6.9 Medium
- oxidized web project webOxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account9.0 Critical
- serosoft academia student information systemA stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student...5.4 Medium
- serosoft academia student information systemA stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student...5.4 Medium
- serosoft academia student information systemIncorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft...9.1 Critical
- ietf rfc 7523In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0...6.9 Medium
- openid connectOpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations....6.9 Medium
- ruby uriURI allows for userinfo Leakage in URI#join, URI#merge, and URI#+3.2 Low
- ruby-lang cgiCGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement4.0 Medium
- ruby-lang cgiCGI has Denial of Service (DoS) potential in Cookie.parse5.8 Medium
- selldone storefrontCross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker...9.0 Critical
- ddsn acora cmsAcora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables...8.8 High
- serosoft academia student information systemSerosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was...6.5 Medium
- serosoft academia student information systemAn Insecure Direct Object References (IDOR) in the component /getStudemtAllDetailsById?studentId...6.5 Medium
- serosoft academia student information systemAn information disclosure vulnerability in the component /rest/cb/executeBasicSearch of Serosoft...7.5 High
- serosoft academia student information systemIncorrect access control in the component /rest/staffResource/update of Serosoft Solutions Pvt...8.1 High
- academiaerp student information systemA stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student...5.4 Medium
- academiaerp student information systemIncorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt...9.1 Critical
- reprisesoftware reprise license managerReprise License Manager 14.2 is vulnerable to reflected cross-site scripting in /goform...6.1 Medium
- apryse webviewerA Cross-Site Scripting (XSS) vulnerability in the Rendering Engine component in Apryse WebViewer...5.4 Medium
- No product listed/api/user/users in the web GUI for the Cubro EXA48200 network packet broker (build 20231025055018...5.4 Medium
- easyvirt dc netscopeMultiple cross-site scripting (XSS) vulnerabilities in EasyVirt DC NetScope <= 8.6.4 allow remote...5.4 Medium
- mavomavo DOM Clobbering vulnerability8.8 High
- umeditor project umeditorA DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via...8.8 High
- piqnt stage.jsStage.js DOM Clobbering vulnerabilty4.9 Medium
- egoist tsuptsup DOM Clobbering vulnerability5.1 Medium
- prismjs prismPrismJS DOM Clobbering vulnerability4.9 Medium
- seajsseajs Cross-site Scripting vulnerability5.4 Medium
- oneadvanced tikit emarketingDirectory Traversal (Local File Inclusion) vulnerability in Tikit (now Advanced) eMarketing...5.1 Medium
- esafenet cdgESAFENET CDG updateorg.jsp sql injection6.9 Medium
- No product listedIncorta Edit Insight csv injection5.3 Medium
- osuuu lightpictureosuuu LightPicture Api.php upload unrestricted upload5.3 Medium
- zframeworks zzzj1983 zz resolve unrestricted upload5.3 Medium
- zframeworks zzzj1983 zz HTTP Request Customer_noticeAction.java sendNotice server-side request forgery5.3 Medium
- Show moreLoading…