CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- control id rh id, assaabloy control id rhid +1 moreControl iD RH iD PDF Document companyId resource injection5.3 Medium
- control id rh idControl iD RH iD API change_password cross site scripting5.1 Medium
- qbnz geshiGeSHi CSS cssgen.php get_var cross site scripting5.1 Medium
- thinkware car dashcam f800 pro, f800 pro firmware +1 moreThinkware Car Dashcam F800 Pro Connection denial of service2.3 Low
- djangoproject djangoDjango is subject to SQL injection through its column aliases7.1 High
- apache camelApache Camel: Camel Message Header Injection via Improper Filtering5.6 Medium
- thinkware car dashcam f800 pro, f800 pro firmware +1 moreThinkware Car Dashcam F800 Pro File Storage access control5.3 Medium
- thinkware car dashcam f800 pro, f800 pro firmware +1 moreThinkware Car Dashcam F800 Pro Configuration File hostapd.conf cleartext storage in a file or on disk2.4 Low
- thinkware car dashcam f800 proThinkware Car Dashcam F800 Pro Device Registration default credentials1.0 Low
- quantico tecnologia prmvQuantico Tecnologia PRMV Login Endpoint login.php sql injection6.9 Medium
- beijing founder electronics founder enjoys all-media acquisition and editing systemBeijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System reportCenter.do electricDocList sql injection5.3 Medium
- beijing founder electronics founder enjoys all-media acquisition and editing systemBeijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System File Protocol imageProxy.do server-side request forgery5.3 Medium
- lordlinus contact us, unknown contact us by lord linus +1 moreContact Us By Lord Linus <= 2.6 - Admin+ Stored XSS via CSRF6.1 Medium
- unknown url shortener | conversion tracking | ab testing | woocommerce, tahminajannat url shortener \| conversion tracking \| ab testing \| woocommerce +1 moreeasy-broken-link-checker <= 9.0.2 - Admin+ Stored XSS3.5 Low
- unknown url shortener | conversion tracking | ab testing | woocommerce, tahminajannat url shortener \| conversion tracking \| ab testing \| woocommerce +1 moreeasy-broken-link-checker <= 9.0.2 - Bulk Actions via CSRF4.3 Medium
- zzskzy warehouse refinement management systemzzskzy Warehouse Refinement Management System AcceptZip.ashx ProcessRequest unrestricted upload5.3 Medium
- shenzhen sixun software sixun shanghui group business management systemShenzhen Sixun Software Sixun Shanghui Group Business Management System Reset Password Interface OperatorStop.asp improper authorization6.3 Medium
- at software solutions atsvdAT Software Solutions ATSVD Esqueceu a senha sql injection6.9 Medium
- user-xiangpeng yaoqishanuser-xiangpeng yaoqishan MediaInfoService.java getMediaLisByFilter sql injection5.3 Medium
- fancywp starter templates by fancywp, starter templates +1 moreStarter Templates by FancyWP <= 2.0.0 - Unauthenticated Blind Server-Side Request Forgery5.3 Medium
- rometheme romethemekit for elementor, rtmkit +1 moreRomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets4.3 Medium
- wpdeveloper essential blocks, wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patterns +1 moreEssential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- amans2k slingblocks – gutenberg blocks by funnelkit (formerly woofunnels), funnelkit slingblocks +1 moreSlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- e4jconnect vikrentcar, e4jvikwp vikrentcar car rental management system +1 moreVikRentCar Car Rental Management System <= 1.4.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- wpxpro xpro addons for elementor, xpro addons — 140+ widgets for elementor +1 more140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- kometschuh gallery stylesGallery Styles <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- plechevandrey wp-recall, wppost wp-recall – registration, profile, commerce & more +1 moreWP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Exeuction6.3 Medium
- plechevandrey wp-recall, wppost wp-recall – registration, profile, commerce & more +1 moreWP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection7.5 High
- plechevandrey wp-recall, wppost wp-recall – registration, profile, commerce & more +1 moreWP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosure4.3 Medium
- plechevandrey wp-recall, wppost wp-recall – registration, profile, commerce & more +1 moreWP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- tychesoftwares product input fields for woocommerceProduct Input Fields for WooCommerce <= 1.12.0 - Unauthenticated Limited File Upload8.1 High
- posimyth the plus addons for elementor, posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerce +1 moreThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- javothemes javo coreJavo Core <= 3.0.0.080 - Unauthenticated Privilege Escalation in ajax_signup9.8 Critical
- coderevolution aiomatic, aiomatic - automatic ai content writer & editor, gpt-3 & gpt-4, chatgpt chatbot & ai toolkit +1 moreAiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload8.8 High
- coderevolution aiomatic, aiomatic - automatic ai content writer & editor, gpt-3 & gpt-4, chatgpt chatbot & ai toolkit +1 moreAiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions5.4 Medium
- shamsbd71 all-in-one addons for elementor – widgetkit, themesgrove all-in-one addons for elementor +1 moreAll-in-One Addons for Elementor – WidgetKit <= 2.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates4.3 Medium
- cyberlord92 miniorange social login and register (discord, google, twitter, linkedin), miniorange social login +1 moreminiOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication Bypass8.1 High
- bestweblayout smtp by bestwebsoft, bestwebsoft smtp +1 moreSMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- intricateweb email keepEmail Keep <= 1.1 - Email Deletion via CSRF5.4 Medium
- intricateweb email keepEmail Keep <= 1.1 - Reflected XSS6.1 Medium
- fooplugins foogallery, gallery by foogallery +1 moreFooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates4.3 Medium
- wpexperts post smtp, saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app +1 morePost SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter4.9 Medium
- fooplugins foogallery, gallery by foogallery +1 moreFooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size6.4 Medium
- tychesoftwares print invoice & delivery notes for woocommercePrint Invoice & Delivery Notes for WooCommerce <= 5.4.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory5.9 Medium
- jtsternberg code snippets cptCode Snippets CPT <= 2.1.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution4.3 Medium
- gandhihitesh9 post meta data managerPost Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation7.2 High
- wpcodefactory wishlist for woocommerce: multi wishlists per customer, wpfactory wishlist for woocommerce +1 moreWishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name6.1 Medium
- andyexeter post lockdownPost Lockdown <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Post Disclosure4.3 Medium
- sksdev allow php executeAllow PHP Execute <= 1.0 - Authenticated (Editor+) PHP Code Injection7.2 High
- laurencebahiirwa years since – timeless textsYears Since – Timeless <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- Show moreLoading…