Skip to content
OpenAdvisories

Archive

21 March 2025

Vulnerabilities first published on this day (UTC), newest first.

← February 2025 2025 / March /21 April 2025 →
  1. 148
  2. 230
  3. 3349
  4. 4148
  5. 5141
  6. 6143
  7. 7113
  8. 840
  9. 924
  10. 1087
  11. 11333
  12. 12105
  13. 1391
  14. 1486
  15. 1544
  16. 1633
  17. 17134
  18. 1871
  19. 1986
  20. 20373
  21. 2166
  22. 2238
  23. 2341
  24. 24158
  25. 25137
  26. 26171
  27. 27377
  28. 28173
  29. 2910
  30. 3016
  31. 31373
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 8.2
    CVE-2025-2609 Scanner template

    MagnusBilling Stored Cross-Site Scripting in Login Logs

    Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-sit…

    MagnusSolution MagnusBilling
  • High 7.6
    CVE-2025-2610 Scanner template

    MagnusBilling Stored Cross-Site Scripting in Alarm Module

    Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusL…

    MagnusSolution MagnusBilling
  • High 7.5
    CVE-2025-30204

    jwt-go allows excessive memory allocation during header parsing

    golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in t…

    golang-jwt jwt katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.3
    CVE-2025-25035

    Jalios JPlatform 10 Multiple Cross-Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.This issue affects JPlatform 10: before 10.0.8 (SP8), before 10.0.7 (SP7), before 10.0.6 (SP6) and Ja…

    Jalios JPlatform
  • High 7.8
    CVE-2025-24915

    When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not…

    Tenable Nessus Agent
  • High 7.5
    CVE-2025-25068

    Bypassing MFA Enforcement on Plugin Endpoints

    Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes.

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • High 8.3
    CVE-2025-26336

    Dell Chassis Management Controller Firmware for Dell PowerEdge FX2, version(s) prior to 2.40.200.202101130302, and Dell…

    Dell Dell Chassis Management Controller (CMC) for PowerEdge VRTX Dell Chassis Management Controller (CMC) for Dell PowerEdge FX2
  • High 8.8
    CVE-2025-2585

    EBM Technologies EBM Maintenance Center - SQL injection

    EBM Maintenance Center From EBM Technologies has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents.

    EBM Technologies EBM Maintenance Center
  • High 8.7
    CVE-2025-29807

    Microsoft Dataverse Remote Code Execution Vulnerability

    Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network.

    Microsoft Microsoft Dataverse
  • High 7.4
    CVE-2024-53349

    Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to esca…

  • High 7.4
    CVE-2024-53350

    Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to esca…

  • High 7.4
    CVE-2024-53348

    CVE-2024-53348 in github.com/loxilb-io/loxilb

    LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privileges.

    github.com/loxilb-io/loxilb Go
  • High 7.7
    CVE-2024-57490

    Guangzhou Hongfan Technology Co., LTD. iOffice20 has any user login vulnerability. An attacker can log in to any system…

  • High 7.3
    CVE-2025-29641

    Phpgurukul Vehicle Record Management System v1.0 is vulnerable to SQL Injection in /index.php via the 'searchinputdata'…

  • High 8.6
    CVE-2025-29230

    Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. T…

  • High 7.2
    CVE-2025-30349 Public exploit EPSS 31%

    Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account tak…

    horde imp php-horde-imp php-horde Debian Ubuntu