CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- geminilabs site reviewsSite Reviews < 7.2.5 - Unauthenticated Stored XSS8.8 High
- synology drive serverImproper neutralization of special elements used in an SQL command ('SQL Injection')...7.5 High
- synology drive serverMissing authentication for critical function vulnerability in the webapi component in Synology...7.5 High
- synology beestation os (bsm), beestation os, diskstation manager (dsm) +3 more +5 moreImproper encoding or escaping of output vulnerability in the webapi component in Synology...5.3 Medium
- themegoods altairAltair <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_current9.8 Critical
- px-lab boombox theme extensionsBoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password8.8 High
- chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes, lifterlms +1 moreLifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing5.3 Medium
clickstorm/cs-seoPackagistClickstorm SEO Allows Cross-Site Scripting (XSS)5.9 Medium- synology camera firmware, bc500 firmware, cc400w firmware +1 more +3 moreA vulnerability regarding out-of-bounds read is found in the video interface. This allows remote...9.8 Critical
- syncology replication service, synology unified controller (dsmuc), unified controller +2 moreOff-by-one error vulnerability in the transmission component in Synology Replication Service...10.0 Critical
- synology beestation os (bsm), beestation os, diskstation manager (dsm) +3 more +5 moreImproper certificate validation vulnerability in the update functionality in Synology BeeStation...4.3 Medium
- synology beestation os (bsm), beestation os, diskstation manager (dsm) +3 more +5 moreImproper encoding or escaping of output vulnerability in the system plugin daemon in Synology...9.8 Critical
- synology diskstation manager (dsm), diskstation manager +1 moreImproper certificate validation vulnerability in the LDAP utilities in Synology DiskStation...7.5 High
codingms/additional-tcaPackagistAdditional TCA Allows Cross-Site Scripting (XSS)5.1 Medium- meta whatsapp cloud serviceThe WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can...3.5 Low
- gnupgIn GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data...2.7 Low
- securenvoy securaccessShearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six...8.6 High
- securenvoy securaccessShearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have...3.5 Low
- mnx smartosSmartOS, as used in Triton Data Center and other products, has static host SSH keys in the...8.3 High
- No product listedIntrexx Portal Server 12.x <= 12.0.2 and 11.x <= 11.9.2 allows XSS in multiple Velocity scripts.6.1 Medium
- emlogAn arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0...6.3 Medium
- emlogAn arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7...9.8 Critical
- tenda ac7 firmwareTenda AC7 V1.0 V15.03.06.44 found a buffer overflow caused by the timeZone parameter in the...9.8 Critical
- tenda ac8 firmwareTenda AC8 V16.03.34.06 was discovered to contain a stack overflow via the src parameter in the...6.5 Medium
- No product listedA vulnerability in Intrexx Portal Server 12.0.2 and earlier which was classified as problematic...6.5 Medium
- No product listedAn issue in Termius Version 9.9.0 through v.9.16.0 allows a physically proximate attacker to...9.8 Critical
- exasol jdbc driverAn issue was discovered in Exasol jdbc driver 24.2.0. Attackers can inject malicious parameters...8.3 High
- datax autobibA reflected cross-site scripting (XSS) vulnerability in AutoBib - Bibliographic collection...6.1 Medium
- wp sharks s2member pros2Member Pro <= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode8.8 High
- hewlett packard enterprise (hpe) aos-cxAuthenticated Sensitive Information Disclosure exposes Credentials in AOS-CX Command Line Interface6.0 Medium
- hewlett packard enterprise (hpe) aos-cxAuthenticated Access Control Vulnerability allows Sensitive Information Disclosure in AOS-CX REST Interface4.3 Medium
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreFailure to Properly Enforce Port ACLs on CPU generated packets in CX 9300 Switches3.3 Low
- impressmodules imfaqimFAQ allows local file inclusion in seo.php6.9 Medium
- parall jspdfjsPDF Bypass Regular Expression Denial of Service (ReDoS)8.7 High
- contaoContao allows cross-site scripting through SVG uploads4.8 Medium
- glpi-project glpiGLPI allows authenticated remote code execution8.6 High
- glpi-project glpiGLPI allows unauthenticated SQL injection through the inventory endpoint7.5 High
- glpi-project glpiGLPI allows SQL injection through the rules configuration8.2 High
linux-cloud-tools-genericTuxCare,linux-cloud-tools-lowlatencyTuxCare,linux-crashdumpTuxCare +9 more +11 moreUpdate of linux-metaNo scorelinux-cloud-tools-genericTuxCare,linux-cloud-tools-lowlatencyTuxCare,linux-crashdumpTuxCare +9 more +11 moreUpdate of linux-metaNo score- red hat directory server 12, directory server 12.4 eus for rhel 9, enterprise linux 10 +5 more +7 more389-ds-base: null pointer dereference leads to denial of service4.9 Medium
- ibm aixIBM AIX command execution9.6 Critical
- ibm aixIBM AIX command execution10.0 Critical
- dell thinos, wyse proprietary os (modern thinos) +1 moreDell ThinOS 2408 and prior, contains an improper permissions vulnerability. A low privileged...7.8 High
- dromara ujcmsDromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting4.8 Medium
- ibm qradar advisor, qradar advisor with watson +1 moreIBM QRadar Advisor server-side request forgery4.1 Medium
- dromara ujcmsDromara ujcms File Upload WebFileUploadController.java upload cross site scripting4.8 Medium
- fortinet fortimailAn improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS...9.0 Critical
- fortinet fortisoarAn improper control of generation of code ('Code Injection') vulnerability [CWE-94] in FortiSOAR...7.7 High
- vestel evc04 configuration interfaceSQLi in Vestel's EVC04 Configuration Interface9.8 Critical
- Show moreLoading…