By publication date

Exploited and new serious CVEs: March 2025

208 records · 26 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 3

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
18Monitor	CVE-2024-13126Proof of concept	Download Manager < 3.3.07 - Unauthenticated Data Exposurew3eden · download manager · CWE-552	Medium4.6	—	0.4%	Mar 16, 2025
32Monitor	CVE-2025-2359No exploit	D-Link DIR-823G DDNS Service HNAP1 SetDDNSSettings improper authorizationdlink · dir-823g firmware · CWE-266 Pre-auth	Medium6.9	—	15.3%	Mar 17, 2025
52Plan	CVE-2024-12971Weaponized	QuickShell Authenticated Command Injectionartica · pandora fms · CWE-77 RCE Command injection	High8.6	—	61.4%	Mar 17, 2025
28Monitor	CVE-2025-25612Proof of concept	FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration funcCWE-79 XSS	High7.1	—	0.9%	Mar 17, 2025
13Monitor	CVE-2025-25618Proof of concept	Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teachechangeweb · unifiedtransform · CWE-284 Broken access control (IDOR)	Low3.3	—	0.4%	Mar 17, 2025
17Monitor	CVE-2025-25621Proof of concept	Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers.changeweb · unifiedtransform · CWE-284 Broken access control (IDOR)	Medium4.3	—	0.3%	Mar 17, 2025
36Monitor	CVE-2025-25650Proof of concept	An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards tCWE-522 Pre-auth Auth bypass Info leak	Critical9.1	—	0.9%	Mar 17, 2025
29Monitor	CVE-2025-26125Proof of concept	An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate priCWE-782 Local privilege escalation	High7.3	—	0.5%	Mar 17, 2025
31Monitor	CVE-2024-40635Proof of concept	containerd has an integer overflow in User ID handlinglinuxfoundation · containerd · CWE-190 Memory safety	High7.8	—	0.3%	Mar 17, 2025
28Monitor	CVE-2025-2473Proof of concept	PHPGurukul Company Visitor Management System Sign In index.php sql injectionphpgurukul · company visitor management system · CWE-74 Pre-auth SQL injection	Medium6.9	—	2.4%	Mar 17, 2025
45Plan	CVE-2025-2449No exploit	NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerabilityni · flexlogger · CWE-22 pre-auth RCE Path traversal	High8.8	—	33.7%	Mar 18, 2025
32Monitor	CVE-2024-44313Proof of concept	TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized tastyigniter · tastyigniter · CWE-284 Broken access control (IDOR)	High8.1	—	0.7%	Mar 18, 2025
65This week	CVE-2025-24799Weaponized	GLPI allows unauthenticated SQL injection through the inventory endpointglpi-project · glpi · CWE-89 Pre-auth SQL injection	Critical9.8	—	86.6%	Mar 18, 2025
41Plan	CVE-2025-24801Proof of concept	GLPI allows authenticated remote code executionglpi-project · glpi · CWE-434 RCE File upload	High8.8	—	20.9%	Mar 18, 2025
31Monitor	CVE-2024-50629Proof of concept	Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology synology · beestation os · CWE-116 Pre-auth	Medium5.3	—	31.7%	Mar 19, 2025
37Monitor	CVE-2024-50630No exploit	Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280,synology · drive server · CWE-306 Pre-auth Auth bypass	High7.5	—	24.5%	Mar 19, 2025
38Monitor	CVE-2024-50631No exploit	Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology synology · drive server · CWE-89 Pre-auth SQL injection	High7.5	—	26.1%	Mar 19, 2025
36Monitor	CVE-2025-1232Proof of concept	Site Reviews < 7.2.5 - Unauthenticated Stored XSSgeminilabs · site reviews · CWE-79 Pre-auth XSS	High8.8	—	1.9%	Mar 19, 2025
39Monitor	CVE-2025-2512Proof of concept	File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Functionfile away project · file away · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.9%	Mar 19, 2025
26Monitor	CVE-2025-30144Proof of concept	Fast-JWT Improperly Validates iss Claimsnearform · fast-jwt · CWE-290 Pre-auth Auth bypass	Medium6.5	—	0.5%	Mar 19, 2025
65This week	CVE-2025-30154Weaponized	Multiple Reviewdog actions were compromised during a specific time periodreviewdog · action-ast-grep · CWE-506 Pre-auth	High8.6	KEV	2.4%	Mar 19, 2025
34Monitor	CVE-2025-29925Proof of concept	XWiki allows unregistered users to access private pages information through REST endpointxwiki · xwiki · CWE-402 Pre-auth	High8.7	—	0.9%	Mar 19, 2025
30Monitor	CVE-2025-27415Proof of concept	Nuxt allows DOS via cache poisoning with payload rendering responsenuxt · nuxt · CWE-349 Pre-auth Denial of service	High7.5	—	0.3%	Mar 19, 2025
40Plan	CVE-2025-2505Proof of concept	Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'philsbury · age gate · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	4.8%	Mar 20, 2025
32Monitor	CVE-2024-10762No exploit	Missing Authorization in lunary-ai/lunarylunary · lunary · CWE-862 Broken access control (IDOR)	High8.1	—	0.5%	Mar 20, 2025
24Monitor	CVE-2024-10812Proof of concept	Open Redirect in binary-husky/gpt_academicbinary-husky · gpt academic · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.5%	Mar 20, 2025
30Monitor	CVE-2024-10821Proof of concept	Denial of Service (DoS) in invoke-ai/invokeaiinvoke-ai · invoke-ai/invokeai · CWE-835 Pre-auth Denial of service	High7.5	—	0.6%	Mar 20, 2025
30Monitor	CVE-2024-10829Proof of concept	Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gptdbgpt · db-gpt · CWE-835 Pre-auth Denial of service	High7.5	—	0.7%	Mar 20, 2025
24Monitor	CVE-2024-10908Proof of concept	Open Redirect in lm-sys/fastchatlm-sys · fastchat · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.7%	Mar 20, 2025
36Monitor	CVE-2024-11042Proof of concept	Arbitrary File Delete in invoke-ai/invokeaiinvoke-ai · invoke-ai/invokeai · CWE-73 Pre-auth Path traversal	Critical9.1	—	1.5%	Mar 20, 2025
24Monitor	CVE-2024-11044Proof of concept	Open Redirect in automatic1111/stable-diffusion-webuiautomatic1111 · stable-diffusion-webui · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.8%	Mar 20, 2025
60This week	CVE-2024-12029Weaponized	Remote Code Execution via Model Deserialization in invoke-ai/invokeaiinvoke-ai · invoke-ai/invokeai · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	5.9%	Mar 20, 2025
30Monitor	CVE-2024-12886Proof of concept	Out-Of-Memory (OOM) Vulnerability in ollama/ollamaollama · ollama/ollama · CWE-409 Pre-auth Denial of service	High7.5	—	0.7%	Mar 20, 2025
60This week	CVE-2024-4990No exploit	Unsafe Reflection in base Component class in yiisoft/yii2yiiframework · yii · CWE-470 pre-auth RCE	Critical9.1	—	80.2%	Mar 20, 2025
39Monitor	CVE-2024-6842Proof of concept	Exposure of Sensitive Information in mintplex-labs/anything-llmmintplexlabs · anythingllm · CWE-306 Pre-auth Auth bypass	High7.5	—	31.1%	Mar 20, 2025
24Monitor	CVE-2024-8021Proof of concept	Open Redirect in gradio-app/gradiogradio project · gradio · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.7%	Mar 20, 2025
31Monitor	CVE-2024-8859Proof of concept	Path Traversal in mlflow/mlflowlfprojects · mlflow · CWE-29 Pre-auth Path traversal	High7.5	—	2.7%	Mar 20, 2025
31Monitor	CVE-2024-9362Proof of concept	Directory Traversal in polyaxon/polyaxonpolyaxon · polyaxon/polyaxon · CWE-22 Pre-auth Path traversal	High7.5	—	4.4%	Mar 20, 2025
27Monitor	CVE-2024-9617Proof of concept	IDOR in danswer-ai/danswerdanswer-ai · danswer-ai/danswer · CWE-639 Broken access control (IDOR)	Medium6.5	—	1.7%	Mar 20, 2025
26Monitor	CVE-2025-0184Proof of concept	Server-Side Request Forgery (SSRF) in langgenius/difylanggenius · dify · CWE-918 SSRF	Medium6.5	—	0.5%	Mar 20, 2025
34Monitor	CVE-2025-0317No exploit	Divide By Zero in ollama/ollamaollama · ollama · CWE-369 Pre-auth Denial of service	High7.5	—	14.1%	Mar 20, 2025
33Monitor	CVE-2025-0453No exploit	Denial of Service through Batched Queries in GraphQL in mlflow/mlflowlfprojects · mlflow · CWE-410 Pre-auth Denial of service	High7.5	—	11.0%	Mar 20, 2025
24Monitor	CVE-2025-27888Proof of concept	Apache Druid: Server-Side Request Forgery and Cross-Site Scriptingapache · druid · CWE-79 SSRF XSS Open redirect	Medium5.8	—	1.7%	Mar 20, 2025
31Monitor	CVE-2025-2539Proof of concept	File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Readfile away project · file away · CWE-327 Pre-auth Weak crypto	High7.5	—	1.6%	Mar 20, 2025
39Monitor	CVE-2024-48590Proof of concept	Inflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the NewsReaderService.inflectra · spirateam · CWE-918 Pre-auth SSRF	Critical9.8	—	0.8%	Mar 20, 2025
24Monitor	CVE-2024-48591Proof of concept	Inflectra SpiraTeam 7.2.00 is vulnerable to Cross Site Scripting (XSS).inflectra · spirateam · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Mar 20, 2025
24Monitor	CVE-2025-2546No exploit	D-Link DIR-618/DIR-605L Firewall Service formAdvFirewall access controldlink · dir-605l firmware · CWE-266 Pre-auth	Medium5.3	—	10.7%	Mar 20, 2025
42Plan	CVE-2025-23120No exploit	A vulnerability allowing remote code execution (RCE) for domain users.veeam · veeam backup \& replication · CWE-502 RCE Deserialization	High8.8	—	24.0%	Mar 20, 2025
66This week	CVE-2025-29927Weaponized	Authorization Bypass in Next.js Middlewarevercel · next.js · CWE-285 Pre-auth Broken access control (IDOR)	Critical9.1	—	99.2%	Mar 21, 2025
22Monitor	CVE-2025-2598Proof of concept	AWS CDK CLI prints AWS credentials retrieved by custom credential pluginsamazon · aws cloud development kit · CWE-497 Info leak	Medium5.7	—	0.3%	Mar 21, 2025
37Monitor	CVE-2025-30349Proof of concept	Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted thorde · imp · CWE-79 Pre-auth XSS	High7.2	—	31.2%	Mar 21, 2025
24Monitor	CVE-2025-2609Proof of concept	MagnusBilling Stored Cross-Site Scripting in Login Logsmagnussolution · magnusbilling · CWE-79 Pre-auth XSS	Medium6.1	—	1.1%	Mar 21, 2025
21Monitor	CVE-2025-2610Proof of concept	MagnusBilling Stored Cross-Site Scripting in Alarm Modulemagnussolution · magnusbilling · CWE-79 XSS	Medium5.4	—	0.9%	Mar 21, 2025
40Plan	CVE-2025-2620Proof of concept	D-Link DAP-1620 Authentication storage mod_graph_auth_uri_handler stack-based overflowdlink · dap-1620 firmware · CWE-119 Pre-auth Memory safety	Critical9.3	—	8.8%	Mar 22, 2025
44Plan	CVE-2023-25610Proof of concept	A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, versfortinet · fortiweb · CWE-124 pre-auth RCE	Critical9.8	—	18.3%	Mar 24, 2025
52Plan	CVE-2025-30208Proof of concept	Vite bypasses server.fs.deny when using `?raw??`vitejs · vite · CWE-200 Pre-auth Info leak	High7.5	—	74.7%	Mar 24, 2025
21Monitor	CVE-2025-22223Proof of concept	Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods.spring · spring security · CWE-290 Pre-auth Auth bypass	Medium5.3	—	0.5%	Mar 24, 2025
91Now	CVE-2025-2746Weaponized	Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypasskentico · xperience · CWE-288 Pre-auth Auth bypass	Critical9.8	KEV	74.0%	Mar 24, 2025
98Now	CVE-2025-2747Weaponized	Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypasskentico · xperience · CWE-288 Pre-auth Auth bypass	Critical9.8	KEV	97.1%	Mar 24, 2025
42Plan	CVE-2025-2748Proof of concept	Kentico Xperience stored cross-site scripting in multiple-file upload functionalitykentico · xperience · CWE-79 Pre-auth XSS	Medium6.1	—	60.5%	Mar 24, 2025
59Plan	CVE-2025-2749Weaponized	Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCEkentico · xperience · CWE-22 RCE Path traversal File upload	High7.2	KEV	4.0%	Mar 24, 2025
21Monitor	CVE-2025-2709Proof of concept	Yonyou UFIDA ERP-NC login.jsp cross site scriptingyonyou · ufida erp-nc · CWE-79 Pre-auth XSS	Medium5.3	—	0.9%	Mar 24, 2025
21Monitor	CVE-2025-2710Proof of concept	Yonyou UFIDA ERP-NC menu.jsp cross site scriptingyonyou · ufida erp-nc · CWE-79 Pre-auth XSS	Medium5.3	—	0.9%	Mar 24, 2025
21Monitor	CVE-2025-2711Proof of concept	Yonyou UFIDA ERP-NC systop.jsp cross site scriptingyonyou · ufida erp-nc · CWE-79 Pre-auth XSS	Medium5.3	—	0.9%	Mar 24, 2025
21Monitor	CVE-2025-2712Proof of concept	Yonyou UFIDA ERP-NC top.jsp cross site scriptingyonyou · ufida erp-nc · CWE-79 Pre-auth XSS	Medium5.3	—	0.8%	Mar 24, 2025
45Plan	CVE-2025-1097Proof of concept	ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotationkubernetes · ingress-nginx · CWE-20 RCE	High8.8	—	33.2%	Mar 24, 2025
60This week	CVE-2025-1098Proof of concept	ingress-nginx controller - configuration injection via unsanitized mirror annotationskubernetes · ingress-nginx · CWE-20 RCE	High8.8	—	82.3%	Mar 24, 2025
69This week	CVE-2025-1974Proof of concept	ingress-nginx admission controller RCE escalationkubernetes · ingress-nginx · CWE-653 pre-auth RCE	Critical9.8	—	99.3%	Mar 24, 2025
44Plan	CVE-2025-24514Proof of concept	ingress-nginx controller - configuration injection via unsanitized auth-url annotationkubernetes · ingress-nginx · CWE-20 RCE	High8.8	—	30.4%	Mar 24, 2025
84Now	CVE-2025-29635Weaponized	A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remotedlink · dir-823x firmware · CWE-77 RCE Command injection	High7.2	KEV	87.9%	Mar 25, 2025
31Monitor	CVE-2025-30567Proof of concept	WordPress WP01 plugin <= 2.6.2 - Arbitrary File Download Vulnerabilitywp01 · wp01 · CWE-22 Pre-auth Path traversal	High7.5	—	2.8%	Mar 25, 2025
37Monitor	CVE-2025-30216Proof of concept	CryptoLib Has Heap Overflow in Crypto_TM_ProcessSecurity due to Unchecked Secondary Header Lengthnasa · cryptolib · CWE-122 pre-auth RCE Memory safety	Critical9.1	—	2.6%	Mar 25, 2025
28Monitor	CVE-2025-1913Proof of concept	Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameterwebtoffee · product import export for woocommerce · CWE-502 Deserialization	High7.2	—	0.8%	Mar 26, 2025
66This week	CVE-2025-2783Weaponized	Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attackergoogle · chrome Pre-auth	High8.3	KEV	9.2%	Mar 26, 2025
35Monitor	CVE-2024-55963Proof of concept	An issue was discovered in Appsmith before 1.51.appsmith · appsmith · CWE-284 Broken access control (IDOR) Denial of service	Medium6.5	—	30.6%	Mar 26, 2025
60This week	CVE-2024-55964Weaponized	An issue was discovered in Appsmith before 1.52.appsmith · appsmith · CWE-94 pre-auth RCE	Critical9.8	—	6.7%	Mar 26, 2025
37Monitor	CVE-2025-20229No exploit	Remote Code Execution through file upload to “$SPLUNK_HOME/var/run/splunk/apptemp“ directory in Splunk Enterprisesplunk · splunk · CWE-284 RCE Broken access control (IDOR)	High8.0	—	16.0%	Mar 26, 2025
35Monitor	CVE-2024-45352Proof of concept	Xiaomi smarthome application Webview has code execution vulnerabilityxiaomi · xiaomi smarthome application · CWE-346 Pre-auth	High8.8	—	0.2%	Mar 26, 2025
35Monitor	CVE-2025-30772Proof of concept	WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerabilitywpclever · wpc smart upsell funnel for woocommerce · CWE-862 Broken access control (IDOR)	High8.8	—	0.6%	Mar 27, 2025
30Monitor	CVE-2025-30921Proof of concept	WordPress Newsletters plugin <= 4.9.9.7 - SQL Injection vulnerabilitytribulant software · newsletters · CWE-89 SQL injection	High7.6	—	0.5%	Mar 27, 2025
32Monitor	CVE-2025-31140No exploit	In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles pagejetbrains · teamcity · CWE-79 Pre-auth XSS	Medium6.1	—	28.0%	Mar 27, 2025
30Monitor	CVE-2025-22652Proof of concept	WordPress Payment Forms for Paystack plugin <= 4.0.1 - SQL Injection vulnerabilitykendysond · payment forms for paystack · CWE-89 SQL injection	High7.6	—	0.8%	Mar 27, 2025
35Monitor	CVE-2025-22783Proof of concept	WordPress SEO Plugin by Squirrly SEO plugin <= 12.4.03 - SQL Injection vulnerabilitysquirrly · seo plugin by squirrly seo · CWE-89 SQL injection	High8.8	—	0.6%	Mar 27, 2025
31Monitor	CVE-2024-12905Proof of concept	An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path TraCWE-22 Pre-auth Path traversal	High7.5	—	2.2%	Mar 27, 2025
53Plan	CVE-2025-29306Proof of concept	An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.foxcms · foxcms · CWE-94 pre-auth RCE	Critical9.8	—	46.5%	Mar 27, 2025
63This week	CVE-2025-2294Proof of concept	Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusionextendthemes · kubio ai page builder · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	78.3%	Mar 28, 2025
43Plan	CVE-2025-28219No exploit	Netgear DC112A V1.0.0.64 has an OS command injection vulnerability in the usb_adv.cgi, which allows remote attackers to execute arbitrary conetgear · dc112a firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	12.8%	Mar 28, 2025
40Plan	CVE-2025-22953Proof of concept	A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.57epicor · human capital management · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	1.8%	Mar 28, 2025
27Monitor	CVE-2025-2927No exploit	ESAFENET CDG getFileTypeList.jsp sql injectionesafenet · cdg · CWE-74 Pre-auth SQL injection	Medium6.9	—	0.6%	Mar 28, 2025
42Plan	CVE-2025-25579No exploit	TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr.totolink · a3002r firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	10.4%	Mar 28, 2025
35Monitor	CVE-2025-2249Proof of concept	SoJ Soundslides <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Uploadsojweb · soj soundslides · CWE-434 RCE File upload	High8.8	—	0.7%	Mar 29, 2025
39Monitor	CVE-2025-2266Proof of concept	Checkout Mestres do WP for WooCommerce 8.6.5 - 8.7.5 - Unauthenticated Arbitrary Options Updatemestresdowp · checkout mestres do wp for woocommerce · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.7%	Mar 29, 2025
25Monitor	CVE-2025-1219Proof of concept	libxml streams use wrong content-type header when requesting a redirected resourcephp · php · CWE-1116 Pre-auth	Medium6.3	—	0.7%	Mar 30, 2025
20Monitor	CVE-2025-2975No exploit	GFI KerioConnect Signature EditHtmlSource cross site scriptinggfi · kerio connect · CWE-79 XSS	Medium5.1	—	0.2%	Mar 31, 2025
30Monitor	CVE-2025-2993No exploit	Tenda FH1202 default.cfg access controltenda · fh1202 firmware · CWE-266 Pre-auth	Medium6.9	—	10.9%	Mar 31, 2025
27Monitor	CVE-2025-2995Proof of concept	Tenda FH1202 Web Management Interface SysToolChangePwd access controltenda · fh1202 firmware · CWE-266 Pre-auth	Medium6.9	—	0.8%	Mar 31, 2025
36Monitor	CVE-2025-30161No exploit	OpenEMR Stored XSS in OpenEMR Bronchitis Formopen-emr · openemr · CWE-80 XSS	High8.4	—	10.8%	Mar 31, 2025
33Monitor	CVE-2025-3002No exploit	Digital China DCME-520 mon_merge_stat_hist.php os command injectiondigital china · dcme-520 · CWE-77 pre-auth RCE Command injection	Medium6.9	—	20.0%	Mar 31, 2025
27Monitor	CVE-2025-3047Proof of concept	Path Traversal in AWS SAM CLI allows file copy to build containeraws · aws serverless application model command line interface · CWE-61 Pre-auth Path traversal	Medium6.9	—	0.7%	Mar 31, 2025
40Plan	CVE-2025-2292Weaponized	Xorcom CompletePBX <= 5.2.35 Authenticated File Disclosurexorcom · completepbx · CWE-22 Path traversal	Medium6.5	—	1.7%	Mar 31, 2025

CVE-2024-13126
18Monitor
Download Manager < 3.3.07 - Unauthenticated Data Exposure
MediumCVSS 4.6Proof of conceptEPSS 0%
w3eden · download managerMar 16, 2025
CVE-2025-2359
32Monitor
D-Link DIR-823G DDNS Service HNAP1 SetDDNSSettings improper authorization
MediumCVSS 6.9No exploitEPSS 15%
- Pre-auth
dlink · dir-823g firmwareMar 17, 2025
CVE-2024-12971
52Plan
QuickShell Authenticated Command Injection
HighCVSS 8.6WeaponizedEPSS 61%
- RCE
- Command injection
artica · pandora fmsMar 17, 2025
CVE-2025-25612
28Monitor
FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration func
HighCVSS 7.1Proof of conceptEPSS 0%
- XSS
Mar 17, 2025
CVE-2025-25618
13Monitor
Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teache
LowCVSS 3.3Proof of conceptEPSS 0%
- Broken access control (IDOR)
changeweb · unifiedtransformMar 17, 2025
CVE-2025-25621
17Monitor
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers.
MediumCVSS 4.3Proof of conceptEPSS 0%
- Broken access control (IDOR)
changeweb · unifiedtransformMar 17, 2025
CVE-2025-25650
36Monitor
An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards t
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
- Info leak
Mar 17, 2025
CVE-2025-26125
29Monitor
An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate pri
HighCVSS 7.3Proof of conceptEPSS 0%
- Local privilege escalation
Mar 17, 2025
CVE-2024-40635
31Monitor
containerd has an integer overflow in User ID handling
HighCVSS 7.8Proof of conceptEPSS 0%
- Memory safety
linuxfoundation · containerdMar 17, 2025
CVE-2025-2473
28Monitor
PHPGurukul Company Visitor Management System Sign In index.php sql injection
MediumCVSS 6.9Proof of conceptEPSS 2%
- Pre-auth
- SQL injection
phpgurukul · company visitor management systemMar 17, 2025
CVE-2025-2449
45Plan
NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 33%
- pre-auth RCE
- Path traversal
ni · flexloggerMar 18, 2025
CVE-2024-44313
32Monitor
TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized
HighCVSS 8.1Proof of conceptEPSS 0%
- Broken access control (IDOR)
tastyigniter · tastyigniterMar 18, 2025
CVE-2025-24799
65This week
GLPI allows unauthenticated SQL injection through the inventory endpoint
CriticalCVSS 9.8WeaponizedEPSS 86%
- Pre-auth
- SQL injection
glpi-project · glpiMar 18, 2025
CVE-2025-24801
41Plan
GLPI allows authenticated remote code execution
HighCVSS 8.8Proof of conceptEPSS 20%
- RCE
- File upload
glpi-project · glpiMar 18, 2025
CVE-2024-50629
31Monitor
Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology
MediumCVSS 5.3Proof of conceptEPSS 31%
- Pre-auth
synology · beestation osMar 19, 2025
CVE-2024-50630
37Monitor
Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280,
HighCVSS 7.5No exploitEPSS 24%
- Pre-auth
- Auth bypass
synology · drive serverMar 19, 2025
CVE-2024-50631
38Monitor
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology
HighCVSS 7.5No exploitEPSS 26%
- Pre-auth
- SQL injection
synology · drive serverMar 19, 2025
CVE-2025-1232
36Monitor
Site Reviews < 7.2.5 - Unauthenticated Stored XSS
HighCVSS 8.8Proof of conceptEPSS 1%
- Pre-auth
- XSS
geminilabs · site reviewsMar 19, 2025
CVE-2025-2512
39Monitor
File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Function
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- File upload
file away project · file awayMar 19, 2025
CVE-2025-30144
26Monitor
Fast-JWT Improperly Validates iss Claims
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
nearform · fast-jwtMar 19, 2025
CVE-2025-30154
65This week
Multiple Reviewdog actions were compromised during a specific time period
HighCVSS 8.6KEVWeaponizedEPSS 2%
- Pre-auth
reviewdog · action-ast-grepMar 19, 2025
CVE-2025-29925
34Monitor
XWiki allows unregistered users to access private pages information through REST endpoint
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
xwiki · xwikiMar 19, 2025
CVE-2025-27415
30Monitor
Nuxt allows DOS via cache poisoning with payload rendering response
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
nuxt · nuxtMar 19, 2025
CVE-2025-2505
40Plan
Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'
CriticalCVSS 9.8Proof of conceptEPSS 4%
- pre-auth RCE
- Path traversal
philsbury · age gateMar 20, 2025
CVE-2024-10762
32Monitor
Missing Authorization in lunary-ai/lunary
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
lunary · lunaryMar 20, 2025
CVE-2024-10812
24Monitor
Open Redirect in binary-husky/gpt_academic
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- Open redirect
binary-husky · gpt academicMar 20, 2025
CVE-2024-10821
30Monitor
Denial of Service (DoS) in invoke-ai/invokeai
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
invoke-ai · invoke-ai/invokeaiMar 20, 2025
CVE-2024-10829
30Monitor
Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gpt
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
dbgpt · db-gptMar 20, 2025
CVE-2024-10908
24Monitor
Open Redirect in lm-sys/fastchat
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- Open redirect
lm-sys · fastchatMar 20, 2025
CVE-2024-11042
36Monitor
Arbitrary File Delete in invoke-ai/invokeai
CriticalCVSS 9.1Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
invoke-ai · invoke-ai/invokeaiMar 20, 2025
CVE-2024-11044
24Monitor
Open Redirect in automatic1111/stable-diffusion-webui
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- Open redirect
automatic1111 · stable-diffusion-webuiMar 20, 2025
CVE-2024-12029
60This week
Remote Code Execution via Model Deserialization in invoke-ai/invokeai
CriticalCVSS 9.8WeaponizedEPSS 5%
- pre-auth RCE
- Deserialization
invoke-ai · invoke-ai/invokeaiMar 20, 2025
CVE-2024-12886
30Monitor
Out-Of-Memory (OOM) Vulnerability in ollama/ollama
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
ollama · ollama/ollamaMar 20, 2025
CVE-2024-4990
60This week
Unsafe Reflection in base Component class in yiisoft/yii2
CriticalCVSS 9.1No exploitEPSS 80%
- pre-auth RCE
yiiframework · yiiMar 20, 2025
CVE-2024-6842
39Monitor
Exposure of Sensitive Information in mintplex-labs/anything-llm
HighCVSS 7.5Proof of conceptEPSS 31%
- Pre-auth
- Auth bypass
mintplexlabs · anythingllmMar 20, 2025
CVE-2024-8021
24Monitor
Open Redirect in gradio-app/gradio
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- Open redirect
gradio project · gradioMar 20, 2025
CVE-2024-8859
31Monitor
Path Traversal in mlflow/mlflow
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
- Path traversal
lfprojects · mlflowMar 20, 2025
CVE-2024-9362
31Monitor
Directory Traversal in polyaxon/polyaxon
HighCVSS 7.5Proof of conceptEPSS 4%
- Pre-auth
- Path traversal
polyaxon · polyaxon/polyaxonMar 20, 2025
CVE-2024-9617
27Monitor
IDOR in danswer-ai/danswer
MediumCVSS 6.5Proof of conceptEPSS 1%
- Broken access control (IDOR)
danswer-ai · danswer-ai/danswerMar 20, 2025
CVE-2025-0184
26Monitor
Server-Side Request Forgery (SSRF) in langgenius/dify
MediumCVSS 6.5Proof of conceptEPSS 0%
- SSRF
langgenius · difyMar 20, 2025
CVE-2025-0317
34Monitor
Divide By Zero in ollama/ollama
HighCVSS 7.5No exploitEPSS 14%
- Pre-auth
- Denial of service
ollama · ollamaMar 20, 2025
CVE-2025-0453
33Monitor
Denial of Service through Batched Queries in GraphQL in mlflow/mlflow
HighCVSS 7.5No exploitEPSS 11%
- Pre-auth
- Denial of service
lfprojects · mlflowMar 20, 2025
CVE-2025-27888
24Monitor
Apache Druid: Server-Side Request Forgery and Cross-Site Scripting
MediumCVSS 5.8Proof of conceptEPSS 1%
- SSRF
- XSS
- Open redirect
apache · druidMar 20, 2025
CVE-2025-2539
31Monitor
File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- Weak crypto
file away project · file awayMar 20, 2025
CVE-2024-48590
39Monitor
Inflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the NewsReaderService.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- SSRF
inflectra · spirateamMar 20, 2025
CVE-2024-48591
24Monitor
Inflectra SpiraTeam 7.2.00 is vulnerable to Cross Site Scripting (XSS).
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
inflectra · spirateamMar 20, 2025
CVE-2025-2546
24Monitor
D-Link DIR-618/DIR-605L Firewall Service formAdvFirewall access control
MediumCVSS 5.3No exploitEPSS 10%
- Pre-auth
dlink · dir-605l firmwareMar 20, 2025
CVE-2025-23120
42Plan
A vulnerability allowing remote code execution (RCE) for domain users.
HighCVSS 8.8No exploitEPSS 24%
- RCE
- Deserialization
veeam · veeam backup \& replicationMar 20, 2025
CVE-2025-29927
66This week
Authorization Bypass in Next.js Middleware
CriticalCVSS 9.1WeaponizedEPSS 99%
- Pre-auth
- Broken access control (IDOR)
vercel · next.jsMar 21, 2025
CVE-2025-2598
22Monitor
AWS CDK CLI prints AWS credentials retrieved by custom credential plugins
MediumCVSS 5.7Proof of conceptEPSS 0%
- Info leak
amazon · aws cloud development kitMar 21, 2025
CVE-2025-30349
37Monitor
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted t
HighCVSS 7.2Proof of conceptEPSS 31%
- Pre-auth
- XSS
horde · impMar 21, 2025
CVE-2025-2609
24Monitor
MagnusBilling Stored Cross-Site Scripting in Login Logs
MediumCVSS 6.1Proof of conceptEPSS 1%
- Pre-auth
- XSS
magnussolution · magnusbillingMar 21, 2025
CVE-2025-2610
21Monitor
MagnusBilling Stored Cross-Site Scripting in Alarm Module
MediumCVSS 5.4Proof of conceptEPSS 0%
- XSS
magnussolution · magnusbillingMar 21, 2025
CVE-2025-2620
40Plan
D-Link DAP-1620 Authentication storage mod_graph_auth_uri_handler stack-based overflow
CriticalCVSS 9.3Proof of conceptEPSS 8%
- Pre-auth
- Memory safety
dlink · dap-1620 firmwareMar 22, 2025
CVE-2023-25610
44Plan
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, vers
CriticalCVSS 9.8Proof of conceptEPSS 18%
- pre-auth RCE
fortinet · fortiwebMar 24, 2025
CVE-2025-30208
52Plan
Vite bypasses server.fs.deny when using `?raw??`
HighCVSS 7.5Proof of conceptEPSS 74%
- Pre-auth
- Info leak
vitejs · viteMar 24, 2025
CVE-2025-22223
21Monitor
Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods.
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
spring · spring securityMar 24, 2025
CVE-2025-2746
91Now
Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
CriticalCVSS 9.8KEVWeaponizedEPSS 74%
- Pre-auth
- Auth bypass
kentico · xperienceMar 24, 2025
CVE-2025-2747
98Now
Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass
CriticalCVSS 9.8KEVWeaponizedEPSS 97%
- Pre-auth
- Auth bypass
kentico · xperienceMar 24, 2025
CVE-2025-2748
42Plan
Kentico Xperience stored cross-site scripting in multiple-file upload functionality
MediumCVSS 6.1Proof of conceptEPSS 60%
- Pre-auth
- XSS
kentico · xperienceMar 24, 2025
CVE-2025-2749
59Plan
Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
HighCVSS 7.2KEVWeaponizedEPSS 4%
- RCE
- Path traversal
- File upload
kentico · xperienceMar 24, 2025
CVE-2025-2709
21Monitor
Yonyou UFIDA ERP-NC login.jsp cross site scripting
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- XSS
yonyou · ufida erp-ncMar 24, 2025
CVE-2025-2710
21Monitor
Yonyou UFIDA ERP-NC menu.jsp cross site scripting
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- XSS
yonyou · ufida erp-ncMar 24, 2025
CVE-2025-2711
21Monitor
Yonyou UFIDA ERP-NC systop.jsp cross site scripting
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- XSS
yonyou · ufida erp-ncMar 24, 2025
CVE-2025-2712
21Monitor
Yonyou UFIDA ERP-NC top.jsp cross site scripting
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- XSS
yonyou · ufida erp-ncMar 24, 2025
CVE-2025-1097
45Plan
ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation
HighCVSS 8.8Proof of conceptEPSS 33%
- RCE
kubernetes · ingress-nginxMar 24, 2025
CVE-2025-1098
60This week
ingress-nginx controller - configuration injection via unsanitized mirror annotations
HighCVSS 8.8Proof of conceptEPSS 82%
- RCE
kubernetes · ingress-nginxMar 24, 2025
CVE-2025-1974
69This week
ingress-nginx admission controller RCE escalation
CriticalCVSS 9.8Proof of conceptEPSS 99%
- pre-auth RCE
kubernetes · ingress-nginxMar 24, 2025
CVE-2025-24514
44Plan
ingress-nginx controller - configuration injection via unsanitized auth-url annotation
HighCVSS 8.8Proof of conceptEPSS 30%
- RCE
kubernetes · ingress-nginxMar 24, 2025
CVE-2025-29635
84Now
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote
HighCVSS 7.2KEVWeaponizedEPSS 87%
- RCE
- Command injection
dlink · dir-823x firmwareMar 25, 2025
CVE-2025-30567
31Monitor
WordPress WP01 plugin <= 2.6.2 - Arbitrary File Download Vulnerability
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
- Path traversal
wp01 · wp01Mar 25, 2025
CVE-2025-30216
37Monitor
CryptoLib Has Heap Overflow in Crypto_TM_ProcessSecurity due to Unchecked Secondary Header Length
CriticalCVSS 9.1Proof of conceptEPSS 2%
- pre-auth RCE
- Memory safety
nasa · cryptolibMar 25, 2025
CVE-2025-1913
28Monitor
Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
HighCVSS 7.2Proof of conceptEPSS 0%
- Deserialization
webtoffee · product import export for woocommerceMar 26, 2025
CVE-2025-2783
66This week
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker
HighCVSS 8.3KEVWeaponizedEPSS 9%
- Pre-auth
google · chromeMar 26, 2025
CVE-2024-55963
35Monitor
An issue was discovered in Appsmith before 1.51.
MediumCVSS 6.5Proof of conceptEPSS 30%
- Broken access control (IDOR)
- Denial of service
appsmith · appsmithMar 26, 2025
CVE-2024-55964
60This week
An issue was discovered in Appsmith before 1.52.
CriticalCVSS 9.8WeaponizedEPSS 6%
- pre-auth RCE
appsmith · appsmithMar 26, 2025
CVE-2025-20229
37Monitor
Remote Code Execution through file upload to “$SPLUNK_HOME/var/run/splunk/apptemp“ directory in Splunk Enterprise
HighCVSS 8.0No exploitEPSS 16%
- RCE
- Broken access control (IDOR)
splunk · splunkMar 26, 2025
CVE-2024-45352
35Monitor
Xiaomi smarthome application Webview has code execution vulnerability
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
xiaomi · xiaomi smarthome applicationMar 26, 2025
CVE-2025-30772
35Monitor
WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability
HighCVSS 8.8Proof of conceptEPSS 0%
- Broken access control (IDOR)
wpclever · wpc smart upsell funnel for woocommerceMar 27, 2025
CVE-2025-30921
30Monitor
WordPress Newsletters plugin <= 4.9.9.7 - SQL Injection vulnerability
HighCVSS 7.6Proof of conceptEPSS 0%
- SQL injection
tribulant software · newslettersMar 27, 2025
CVE-2025-31140
32Monitor
In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page
MediumCVSS 6.1No exploitEPSS 28%
- Pre-auth
- XSS
jetbrains · teamcityMar 27, 2025
CVE-2025-22652
30Monitor
WordPress Payment Forms for Paystack plugin <= 4.0.1 - SQL Injection vulnerability
HighCVSS 7.6Proof of conceptEPSS 0%
- SQL injection
kendysond · payment forms for paystackMar 27, 2025
CVE-2025-22783
35Monitor
WordPress SEO Plugin by Squirrly SEO plugin <= 12.4.03 - SQL Injection vulnerability
HighCVSS 8.8Proof of conceptEPSS 0%
- SQL injection
squirrly · seo plugin by squirrly seoMar 27, 2025
CVE-2024-12905
31Monitor
An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Tra
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
- Path traversal
Mar 27, 2025
CVE-2025-29306
53Plan
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.
CriticalCVSS 9.8Proof of conceptEPSS 46%
- pre-auth RCE
foxcms · foxcmsMar 27, 2025
CVE-2025-2294
63This week
Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
CriticalCVSS 9.8Proof of conceptEPSS 78%
- pre-auth RCE
- Path traversal
extendthemes · kubio ai page builderMar 28, 2025
CVE-2025-28219
43Plan
Netgear DC112A V1.0.0.64 has an OS command injection vulnerability in the usb_adv.cgi, which allows remote attackers to execute arbitrary co
CriticalCVSS 9.8No exploitEPSS 12%
- pre-auth RCE
- Command injection
netgear · dc112a firmwareMar 28, 2025
CVE-2025-22953
40Plan
A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.57
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- SQL injection
epicor · human capital managementMar 28, 2025
CVE-2025-2927
27Monitor
ESAFENET CDG getFileTypeList.jsp sql injection
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
- SQL injection
esafenet · cdgMar 28, 2025
CVE-2025-25579
42Plan
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr.
CriticalCVSS 9.8No exploitEPSS 10%
- pre-auth RCE
- Command injection
totolink · a3002r firmwareMar 28, 2025
CVE-2025-2249
35Monitor
SoJ Soundslides <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
- File upload
sojweb · soj soundslidesMar 29, 2025
CVE-2025-2266
39Monitor
Checkout Mestres do WP for WooCommerce 8.6.5 - 8.7.5 - Unauthenticated Arbitrary Options Update
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
mestresdowp · checkout mestres do wp for woocommerceMar 29, 2025
CVE-2025-1219
25Monitor
libxml streams use wrong content-type header when requesting a redirected resource
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
php · phpMar 30, 2025
CVE-2025-2975
20Monitor
GFI KerioConnect Signature EditHtmlSource cross site scripting
MediumCVSS 5.1No exploitEPSS 0%
- XSS
gfi · kerio connectMar 31, 2025
CVE-2025-2993
30Monitor
Tenda FH1202 default.cfg access control
MediumCVSS 6.9No exploitEPSS 10%
- Pre-auth
tenda · fh1202 firmwareMar 31, 2025
CVE-2025-2995
27Monitor
Tenda FH1202 Web Management Interface SysToolChangePwd access control
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
tenda · fh1202 firmwareMar 31, 2025
CVE-2025-30161
36Monitor
OpenEMR Stored XSS in OpenEMR Bronchitis Form
HighCVSS 8.4No exploitEPSS 10%
- XSS
open-emr · openemrMar 31, 2025
CVE-2025-3002
33Monitor
Digital China DCME-520 mon_merge_stat_hist.php os command injection
MediumCVSS 6.9No exploitEPSS 20%
- pre-auth RCE
- Command injection
digital china · dcme-520Mar 31, 2025
CVE-2025-3047
27Monitor
Path Traversal in AWS SAM CLI allows file copy to build container
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
aws · aws serverless application model command line interfaceMar 31, 2025
CVE-2025-2292
40Plan
Xorcom CompletePBX <= 5.2.35 Authenticated File Disclosure
MediumCVSS 6.5WeaponizedEPSS 1%
- Path traversal
xorcom · completepbxMar 31, 2025