CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- dvs11 random posts, mp3 player + sharebuttonWordPress Random Posts, Mp3 Player + ShareButton plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- hikashop, hikashop.com hikashop component for joomla +1 moreExtension - hikashop.com - Privilege escalation vulnerability Hikashop component version 1.0.0 - 5.1.3 for Joomla6.5 Medium
- 274056675 springboot-openai-chatgpt274056675 springboot-openai-chatgpt Number of Question questionCou updateQuestionCou behavioral workflow5.3 Medium
- 274056675 springboot-openai-chatgpt274056675 springboot-openai-chatgpt OpenController.java hard-coded credentials6.9 Medium
- 274056675 springboot-openai-chatgpt274056675 springboot-openai-chatgpt addData logic error5.3 Medium
- tripetto, tripetto wordpress form builder plugin for contact forms, surveys and quizzes – tripetto +1 moreTripetto <= 8.0.9 - Cross-Site Request Forgery to Arbitrary Results Deletion4.3 Medium
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGive <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function6.5 Medium
- i13websolution thumbnail carousel sliderThumbnail carousel slider <= 1.0.4 - Authenticated (Admin+) SQL Injection4.9 Medium
- boopathi rajan wp test emailWP Test Email <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting7.2 High
- red hat satellite 6, satellite server +1 moreForeman: disclosure of executed commands and outputs in foreman / red hat satellite3.3 Low
- tripetto, tripetto wordpress form builder plugin for contact forms, surveys and quizzes – tripetto +1 moreWordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.9 - Unauthenticated Stored Cross-Site Scripting7.2 High
- shinecommerce traveler, shinetheme travel booking wordpress theme +1 moreTraveler <= 3.1.8 - Reflected Cross-Site Scripting6.1 Medium
- shinecommerce traveler, shinetheme travel booking wordpress theme +1 moreTraveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post9.8 Critical
- igexsolutions wpschoolpress, jdsofttech school management system – wpschoolpress +1 moreSchool Management System – WPSchoolPress <= 2.2.16 - Authenticated (Parent+) SQL Injection6.5 Medium
- igexsolutions wpschoolpress, jdsofttech school management system – wpschoolpress +1 moreSchool Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Arbitrary User Deletion4.3 Medium
- igexsolutions wpschoolpress, jdsofttech school management system – wpschoolpress +1 moreSchool Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover8.8 High
- igexsolutions wpschoolpress, jdsofttech school management system – wpschoolpress +1 moreSchool Management System – WPSchoolPress <= 2.2.17 - Authenticated (Teacher+) SQL Injection6.5 Medium
- codexpert wc affiliate, wc affiliate – woocommerce affiliate plugin +1 moreWC Affiliate – A Complete WooCommerce Affiliate Plugin <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wf-export-all6.5 Medium
- wp01ru wp01, wp01 – speed, security, seo consultant +1 moreWP01 – Speed, Security, SEO consultant <= 2.6.2 - Authenticated (Subscriber+) Arbitrary File Download6.5 Medium
- pixelstatspixelstats <= 0.8.2 - Reflected Cross-Site Scripting6.1 Medium
- zoorum commentsZoorum Comments <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- stylemix directory listings wordpress plugin – ulisting, stylemixthemes ulisting +1 moreDirectory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- stylemix directory listings wordpress plugin – ulisting, stylemixthemes ulisting +1 moreDirectory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection8.8 High
- artifex ghostscriptAn issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can...9.8 Critical
- artifex ghostscriptAn issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print...9.8 Critical
- artifex ghostscriptAn issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when...7.8 High
- artifex ghostscriptAn issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an...7.8 High
- artifex ghostscriptAn issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a...7.8 High
- artifex ghostscriptAn issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression...9.8 Critical
- artifex ghostscriptAn issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has...9.8 Critical
- artifex ghostscriptAn issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during...7.8 High
librsvgOSS-FuzzUNKNOWN READ in _blit_xrgb32_lerp_spansNo score- tj-actions changed-files, changed-files github action +1 moretj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.8.6 High
- 274056675 springboot-openai-chatgpt274056675 springboot-openai-chatgpt User submit improper authorization6.9 Medium
- tianocore edk2Potential iSCSI R2T PDU Vulnerability3.5 Low
- hdfgroup hdf5HDF5 Metadata Attribute Decoder H5MM_strndup heap-based overflow4.8 Medium
- hdfgroup hdf5HDF5 Type Conversion Logic H5T__bit_copy heap-based overflow4.8 Medium
- hdfgroup hdf5HDF5 Scale-Offset Filter H5Z__scaleoffset_decompress_one_byte heap-based overflow4.8 Medium
- labredescefetrj wegiaWeGIA Cross-Site Scripting (XSS) Stored in endpoint `adicionar_tipo_docs_atendido.php` parameter `tipo`6.4 Medium
- jitbit htmlsanitizerHtmlSanitizer vulnerable to XSS when used with contentEditable5.3 Medium
- flowiseFlowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API10.0 Critical
- logicaldoc community, enterprise +1 moreBlind SQL Injection in Logout8.7 High
- logicaldoc, logicaldoc enterprise +1 moreReflected Cross-Site Scripting (XSS)6.4 Medium
- logicaldoc community, enterprise +1 moreArbitrary File Read via Document API7.1 High
- logicaldoc, logicaldoc community, enterprise +2 moreRemote Code Execution (RCE) via Arbitrary File Write In Document API8.7 High
- logicaldoc, logicaldoc community, enterprise +2 moreRemote Code Execution (RCE) via Automation Scripting8.6 High
- logicaldoc community, enterprise +1 moreBlind SQLi in Saved Search7.1 High
- logicaldoc community, enterprise +1 moreBlind SQLi in Document History7.1 High
- logicaldoc community, enterprise +1 moreBlind SQLi in Login8.7 High
- davidosipov postquantum-feldman-vssPost-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations5.8 Medium
- Show moreLoading…