CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- rustcrypto aeadsAEADs/ascon-aead: Plaintext exposed in decrypt_in_place_detached even on tag verification failure5.6 Medium
- ttop32 mousetooltiptranslatorServer-Side Request Forgery (SSRF) in MouseTooltipTranslator6.9 Medium
- danielgatis rembgRembg CORS misconfiguration8.7 High
- danielgatis rembgRembg allows SSRF via /api/remove6.9 Medium
- vim, netapp hci compute node +1 moreImproper Input Validation in Vim7.1 High
- factionsecurity factionFACTION Allows Authentication Bypass via User Creation7.5 High
- paragon software backup and recovery, disk wiper, hard disk manager +9 more +11 moreCVE-2025-02857.8 High
- paragon software backup and recovery, disk wiper, drive copy +9 more +11 moreCVE-2025-02868.4 High
- paragon software backup and recovery, disk wiper, drive copy +9 more +11 moreCVE-2025-02875.1 Medium
- paragon software backup and recovery, disk wiper, drive copy +9 more +11 moreCVE-2025-02887.8 High
- paragon software backup and recovery, disk wiper, drive copy +9 more +11 moreCVE-2025-02897.8 High
- jasonlovesdoggo abacusGoroutine Leak in Abacus SSE Implementation7.5 High
- labredescefetrj wegiaDenial of Service (DoS) in WeGIA due to Recursive Crawling of Dynamic URLs9.2 Critical
- labredescefetrj wegiaWeGIA contains a Stored Cross-Site Scripting (XSS) in 'atendido_parentesco_adicionar.php' via the 'descricao' parameter6.4 Medium
- apache rangerApache Ranger: Improper Neutralization of Formula Elements in a CSV File9.8 Critical
- labredescefetrj wegiaWeGIA contains a Stored Cross-Site Scripting (XSS) in 'adicionar_tipo_atendido.php' via the 'tipo' parameter6.4 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab7.7 High
- labredescefetrj wegiaWeGIA Contains a Stored Cross-Site Scripting (XSS) in 'adicionar_status_atendido.php' via the 'status' parameter6.4 Medium
- enalean tuleapTuleap allows XSS via the tracker names used in the semantic timeframe deletion message4.8 Medium
- enalean tuleapTuleap allows default values to be cleared from field configuration5.4 Medium
- binary-husky gpt academicGPT Academic allows arbitary file read by tarfile uncompress within softlink7.5 High
- ibm engineering requirements management doors nextIBM Engineering Requirements Management DOORS Next information disclosure7.5 High
- ibm engineering requirements management doors nextIBM Engineering Requirements Management DOORS Next information disclosure7.5 High
- ibm engineering requirements management doors nextIBM Engineering Requirements Management DOORS Next file download8.8 High
- dpgaspar flask-appbuilderObservable Response Discrepancy in flask-appbuilder3.7 Low
- proliz software obs, prolizyazilim student affairs information system +1 morePath Traversal in Proliz Software's OBS9.8 Critical
- proliz software obs, prolizyazilim student affairs information system +1 moreIDOR in Proliz Software's OBS7.5 High
- ibm business automation workflow, business automation workflow enterprise service bus +1 moreIBM Business Automation Workflow cross-site scripting5.4 Medium
- heinlein-support check mk python apiInsecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api7.7 High
- softdiscover zigaform, zigaform – price calculator & cost estimation form builder lite +1 moreWordPress Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- softdiscover zigaformWordPress Zigaform – Form Builder Lite plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - SQL Injection vulnerability9.3 Critical
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- freshface ark theme core, arktheme the ark +1 moreWordPress Ark Theme Core plugin < 1.71.0 - Unauthenticated Remote Code Execution (RCE) vulnerability10.0 Critical
- stiofan events calendar for geodirectory, wpgeodirectory events calendar* +1 moreWordPress Events Calendar for GeoDirectory plugin <= 2.3.14 - PHP Object Injection vulnerability8.8 High
- eniture small package quotes, enituretechnology small package quotes – unishippers edition +1 moreWordPress Small Package Quotes – Unishippers Edition plugin <= 2.4.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- hasthemes wp templataWordPress WP Templata plugin <= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- bowo variable inspectorWordPress Variable Inspector plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- beaver builder wordpress assistantWordPress Assistant Plugin <= 1.5.1 - PHP Object Injection vulnerability7.2 High
- cristián lávaque s2memberWordPress s2Member Plugin <= 241216 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- lynk flashfaderWordPress Flashfader Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- david ghedini acugis leaflet mapsWordPress AcuGIS Leaflet Maps Plugin <= 5.1.1.0 - Multiple Cross Site Scripting (XSS) vulnerabilities7.1 High
- andrew fisher woo codice fiscaleWordPress WOO Codice Fiscale plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- axelkeller gpx viewerWordPress GPX Viewer plugin <= 2.2.11 - Path Traversal vulnerability4.9 Medium
- winking affiliate links managerWordPress Affiliate Links Manager Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability5.8 Medium
- alberto cocchiara db tables import/exportWordPress DB Tables Import/Export Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- enituretechnology residential address detectionWordPress Residential Address Detection Plugin <= 2.5.4 - Arbitrary Option Update to Privilege Escalation vulnerability9.8 Critical
- anton aleksandrov .htaccess login blockWordPress .htaccess Login block Plugin <= 0.9a - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- enituretechnology small package quotes – worldwide express editionWordPress Small Package Quotes – Worldwide Express Edition Plugin <= 5.2.18 - SQL Injection vulnerability9.3 Critical
- creativeitem doctor appointment bookingWordPress Doctor Appointment Booking Plugin <= 1.0.0 - Local File Inclusion vulnerability7.5 High
- Show moreLoading…