CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- starsea99 starsea-mallStarSea99 starsea-mall save cross site scripting5.1 Medium
- phpgurukul human metapneumovirus testing management system, human metapneumovirus +1 morePHPGurukul Human Metapneumovirus Testing Management System Search Report Page search-report.php cross site scripting5.1 Medium
- cifi seo plugin by squirrly seo, seo squirrly plugin by squirrly seo +1 moreSEO Plugin by Squirrly SEO <= 12.4.05 - Authenticated (Subscriber+) SQL Injection via search Parameter6.5 Medium
- pickplugins related posts, inline related posts, contextual related posts, related content by pickpluginsRelated Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins <= 2.0.59 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
els-defineTuxCareUpdate of els-defineNo score- sage 200 spainSMB forced authentication vulnerability in Sage 200 Spain7.1 High
- sage 200 spainPass-Back vulnerability in Sage 200 Spain7.1 High
- unknown wordpress activity o meter, erwinwolff wordpress activity-o-meter +1 moreWordPress Activity O Meter <= 1 - Reflected XSS7.1 High
- reservit hotel, unknown reservit hotel +1 moreReservit Hotel < 3.0 - Admin+ Stored XSS4.8 Medium
- davidanderson wpget api – connect to any external rest apiWPGet API <= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgery5.5 Medium
- vektor-inc vk blocksVK Blocks <= 1.94.2.2 - Missing Authorization to Sensitive Information Exposure4.3 Medium
- psmplugins supportcandy – helpdesk & customer support ticket systemSupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference4.3 Medium
- advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 moreAdvanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- linux, linux kernel +1 moredrm/panthor: avoid garbage value in panthor_ioctl_dev_query()5.5 Medium
- linux, linux kernel +1 moreamdkfd: properly free gang_ctx_bo when failed to init user queue7.8 High
- linux, linux kernel +1 morecpufreq/amd-pstate: Fix cpufreq_policy ref counting5.5 Medium
- linux, linux kernel +1 morethermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header5.5 Medium
- linux, linux kernel +1 moreKVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop7.3 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreusb: gadget: core: flush gadget workqueue after device removal5.5 Medium
- linux, linux kernel +1 moreio_uring/kbuf: reallocate buf lists on upgrade7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreusb: gadget: f_midi: fix MIDI Streaming descriptor lengths5.5 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsquared appointment booking calendar +1 moreAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting6.1 Medium
- uxper golo, golo - city travel guide wordpress theme +1 moreGolo - Directory & Listing, Travel WordPress Theme <= 1.6.10 - Missing Authorization to Privilege Escalation via Unauthenticated Arbitrary User Password Change9.8 Critical
- sfwebservice inwave jobs, injob +1 moreInWave Jobs <= 3.5.1 - Unauthenticated Privilege Escalation via Password Reset9.8 Critical
- imithemes eventer, eventer - wordpress event & booking manager plugin +1 moreEventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id8.8 High
- dasinfomedia school management system for wordpress, school management system +1 moreSchool Management System for Wordpress <= 93.0.0 - Authenticated (Student+) Account Takeover and Privilege Escalation8.8 High
- dasinfomedia school management system for wordpress, school management system +1 moreSchool Management System for Wordpress <= 93.0.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion5.3 Medium
- dasinfomedia school management system for wordpress, school management system +1 moreSchool Management System for Wordpress <= 92.0.0 - Authenticated (Student+) SQL Injection via 'view-attendance'6.5 Medium
- platformly platform.ly for woocommercePlatform.ly for WooCommerce <= 1.1.6 - Unauthenticated Blind Server-Side Request Forgery5.3 Medium
- hero plugins maps premium, heroplugins hero maps premium +1 moreHero Maps Premium - Customizable Google Maps Plugin <= 2.3.9 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- chimpstudio cs frameworkCS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read7.5 High
- dasinfomedia school management system for wordpress, school management system +1 moreSchool Management System for Wordpress <= 93.0.0 - Reflected Cross-Site Scripting5.3 Medium
- fwdesign ultimate video player wordpress & woocommerce pluginUltimate Video Player <= 10.0 - Unauthenticated Arbitrary File Download7.5 High
- chimpstudio cs frameworkCS Framework <= 7.0 - Authenticated (Subscriber+) Arbitrary File Deletion8.8 High
- dasinfomedia school management system for wordpress, school management system +1 moreSchool Management System for Wordpress <= 92.0.0 - Authenticated (Subscriber+) SQL Injection via 'mj_smgt_show_event_task'6.5 Medium
- dell thinos, wyse proprietary os (modern thinos) +1 moreDell ThinOS 2411 and prior, contains an Improper Neutralization of Special Elements used in a...7.8 High
- imagination technologies graphics ddkGPU DDK - Exploitable kernel double free on apsFenceSyncCheckpoints allocated with arbitrary size7.8 High
- imagination technologies graphics ddkGPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned address5.5 Medium
- bestwebsoft gallery by bestwebsoft – customizable image and photo galleries for wordpressGallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.3 - Authenticated (Administrator+) PHP Object Injection7.2 High
- admintwentytwenty uipress lite | effortless custom dashboards, admin themes and pagesUiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.04 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- flexmls flexmls® idx pluginFlexmls® IDX <= 3.14.27 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- villatheme curcy - woocommerce multi currency - currency switcherCURCY - WooCommerce Multi Currency - Currency Switcher <= 2.3.6 - Unauthenticated SQL Injection7.5 High
- mvpthemes flex mag - responsive wordpress news themeFlex Mag - Responsive WordPress News Theme <= 3.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion8.1 High
- pickplugins wishlistWishlist <= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- whyun wpcom memberWPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone'9.8 Critical
- projectworlds life insurance management systemprojectworlds Life Insurance Management System search.php sql injection6.9 Medium
- projectworlds life insurance management systemprojectworlds Life Insurance Management System updateAgent.php sql injection6.9 Medium
- projectworlds life insurance management systemprojectworlds Life Insurance Management System editAgent.php sql injection6.9 Medium
- projectworlds life insurance management systemprojectworlds Life Insurance Management System deletePayment.php sql injection6.9 Medium
- projectworlds life insurance management systemprojectworlds Life Insurance Management System deleteNominee.php sql injection6.9 Medium
- Show moreLoading…