CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- phpgurukul art gallery management systemPHPGurukul Art Gallery Management System view-enquiry-detail.php sql injection6.9 Medium
- phpgurukul art gallery management systemPHPGurukul Art Gallery Management System search.php sql injection6.9 Medium
- phpgurukul art gallery management systemPHPGurukul Art Gallery Management System admin-profile.php sql injection6.9 Medium
- phpgurukul art gallery management systemPHPGurukul Art Gallery Management System product.php cross site scripting5.1 Medium
- phpgurukul art gallery management systemPHPGurukul Art Gallery Management System add-art-product.php sql injection6.9 Medium
- phpgurukul art gallery management systemPHPGurukul Art Gallery Management System edit-art-type-detail.php sql injection6.9 Medium
- phpgurukul art gallery management systemPHPGurukul Art Gallery Management System edit-art-product-detail.php sql injection6.9 Medium
- podsfoundation podsPods < 3.2.8.2 - Admin+ SQL Injection9.8 Critical
- kylephillips nested pagesNested Pages < 3.2.13 - Contributor+ Stored XSS4.8 Medium
- phpgurukul art gallery management systemPHPGurukul Art Gallery Management System edit-artist-detail.php sql injection6.9 Medium
- phpgurukul doctor appointment management systemPHPGurukul Doctor Appointment Management System appointment-bwdates-reports-details.php sql injection6.9 Medium
- jizhicmsJIZHICMS Article release.html improper authorization5.3 Medium
- jizhicmsJIZHICMS Article release.html improper authorization5.3 Medium
- jizhicmsJIZHICMS Account Profile Page userinfo.html improper authorization5.3 Medium
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved checks. This issue is fixed in Safari 18.3, visionOS 2.3,...8.8 High
- phpgurukul art gallery management systemPHPGurukul Art Gallery Management System art-enquiry.php sql injection5.3 Medium
- phpgurukul art gallery management systemPHPGurukul Art Gallery Management System contactus.php sql injection5.3 Medium
- mayurik advocate office management system, sourcecodester kortex lite advocate office management system +1 moreSourceCodester Kortex Lite Advocate Office Management System edit_case.php sql injection5.3 Medium
- westboy cicadascmswestboy CicadasCMS page sql injection5.3 Medium
- westboy cicadascmswestboy CicadasCMS save sql injection5.3 Medium
- westboy cicadascmswestboy CicadasCMS save cross site scripting5.1 Medium
- aizuda snail-jobaizuda snail-job Workflow-Task Management Module check-node-expression getRuntime deserialization5.3 Medium
- d-link dap-1620, dlink dap-1620 firmware +1 moreD-Link DAP-1620 storage check_dws_cookie stack-based overflow9.3 Critical
- d-link dap-1620, dlink dap-1620 firmware +1 moreD-Link DAP-1620 Authentication storage mod_graph_auth_uri_handler stack-based overflow9.3 Critical
- d-link dap-1620, dlink dap-1620 firmware +1 moreD-Link DAP-1620 Cookie storage check_dws_cookie stack-based overflow9.3 Critical
- d-link dap-1620, dlink dap-1620 firmware +1 moreD-Link DAP-1620 Path api set_ws_action heap-based overflow9.3 Critical
- amans2k funnelkit automations – email marketing automation and crm for wordpress & woocommerceRecover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.1 - Unauthenticated SQL Injection via 'automationId'7.5 High
- yangyouwang 杨有旺 crud 简约后台管理系统yangyouwang 杨有旺 crud 简约后台管理系统 Department Page cross site scripting4.8 Medium
- apache oozieApache Oozie: XSS in Oozie Web Console5.4 Medium
- webtoffee export and import users and customers, import export wordpress users +1 moreExport and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function4.9 Medium
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure5.3 Medium
- webtoffee export and import users and customers, import export wordpress users +1 moreExport and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function7.6 High
- webtoffee export and import users and customers, import export wordpress users +1 moreExport and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function2.7 Low
- webtoffee export and import users and customers, import export wordpress users +1 moreExport and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter7.2 High
- bitspecter suiteBitspecter Suite <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- yangyouwang 杨有旺 crud 简约后台管理系统yangyouwang 杨有旺 crud 简约后台管理系统 Role Management Page cross site scripting4.8 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing5.3 Medium
- allhart code cloneCode Clone <= 0.9 - Authenticated (Administrator+) SQL Injection via snippetId Parameter4.9 Medium
- ashikcse cits support svg, webp media and ttf,otf file upload, use custom fontsCITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts <= 4.2 - Cross-Site Request Forgery to Font Assignment Deletion4.3 Medium
- wclovers wcfm – multivendor marketplace rest api for woocommerceWooCommerce Multivendor Marketplace – REST API <= 1.6.2 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- thethemefoundry your friendly drag and drop page builder — make builderMake Builder <= 1.1.10 - Authenticated (Subscriber+) Server-Side Request Forgery via make_builder_ajax_subscribe Function6.4 Medium
- pienaro gotcha | gesture-based captchaGotcha | Gesture-based Captcha <= 1.0.0 - Reflected Cross-Site Scripting via menu Parameter6.1 Medium
- landwire block logic – full block display controlBlock Logic <= 1.0.8 - Authenticated (Contributor+) Remote Code Execution8.8 High
- skustes multi video boxMulti Video Box <= 1.5.2 - Reflected Cross-Site Scripting via video_id and group_id Parameters6.1 Medium
- ashikcse cits support svg, webp media and ttf,otf file upload, use custom fontsCITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts <= 4.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- duogeek easy custom admin barEasy Custom Admin Bar <= 1.0 - Reflected Cross-Site Scripting via msg Parameter6.1 Medium
- cryokeyCryoKey <= 2.4 - Reflected Cross-Site Scripting via 'ckemail' Parameter4.7 Medium
- metagauss profilegrid, profilegrid – user profiles, groups and communities +1 moreProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- metagauss profilegrid, profilegrid – user profiles, groups and communities +1 moreProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management4.3 Medium
- contrid newslettersNewsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter6.1 Medium
- Show moreLoading…