Skip to content
OpenAdvisories

Archive

30 March 2025

Vulnerabilities first published on this day (UTC), newest first.

← February 2025 2025 / March /30 April 2025 →
  1. 148
  2. 230
  3. 3349
  4. 4148
  5. 5141
  6. 6143
  7. 7113
  8. 840
  9. 924
  10. 1087
  11. 11333
  12. 12105
  13. 1391
  14. 1486
  15. 1544
  16. 1633
  17. 17134
  18. 1871
  19. 1986
  20. 20373
  21. 2166
  22. 2238
  23. 2341
  24. 24158
  25. 25137
  26. 26171
  27. 27377
  28. 28173
  29. 2910
  30. 3016
  31. 31373
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-2961

    opensolon org.noear.solon.core.handle.RenderManager aa render_mav path traversal

    A vulnerability classified as problematic was found in opensolon up to 3.1.0. This vulnerability affects the function render_mav of the file /aa of the component org.noear.solon.core.handle.RenderManager. The manipulation of the argument template with the inp…

    org.noear:solon-view Maven
  • Medium 6.5
    CVE-2025-2960

    TRENDnet TEW-637AP/TEW-638APB HTTP Request goahead sub_41DED0 null pointer dereference

    A vulnerability classified as problematic has been found in TRENDnet TEW-637AP and TEW-638APB 1.2.7/1.3.0.106. This affects the function sub_41DED0 of the file /bin/goahead of the component HTTP Request Handler. The manipulation leads to null pointer derefere…

    Trendnet TEW-638APB TEW-637AP
  • Medium 6.5
    CVE-2025-2959

    TRENDnet TEW-410APB HTTP Request httpd sub_4019A0 null pointer dereference

    A vulnerability was found in TRENDnet TEW-410APB 1.3.06b. It has been rated as problematic. Affected by this issue is the function sub_4019A0 of the file /usr/sbin/httpd of the component HTTP Request Handler. The manipulation leads to null pointer dereference…

    Trendnet TEW-410APB
  • Medium 6.5
    CVE-2025-2958

    TRENDnet TEW-818DRU HTTP Request httpd denial of service

    A vulnerability was found in TRENDnet TEW-818DRU 1.0.14.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/httpd of the component HTTP Request Handler. The manipulation leads to denial of s…

    Trendnet TEW-818DRU
  • Medium 6.5
    CVE-2025-2957

    TRENDnet TEW-411BRP+ HTTP Request httpd sub_401DB0 null pointer dereference

    A vulnerability was found in TRENDnet TEW-411BRP+ 2.07. It has been classified as problematic. Affected is the function sub_401DB0 of the file /usr/sbin/httpd of the component HTTP Request Handler. The manipulation leads to null pointer dereference. The attac…

    Trendnet TEW-411BRP+
  • Medium 6.5
    CVE-2025-2956

    TRENDnet TI-G102i HTTP Request lighttpd plugins_call_handle_uri_raw null pointer dereference

    A vulnerability was found in TRENDnet TI-G102i 1.0.7.S0_ /1.0.8.S0_ and classified as problematic. This issue affects the function plugins_call_handle_uri_raw of the file /usr/sbin/lighttpd of the component HTTP Request Handler. The manipulation leads to null…

    Trendnet TI-G102i
  • Medium 5.3
    CVE-2025-2955

    TOTOLINK A3000RU IBMS Configuration File ExportIbmsConfig.sh access control

    A vulnerability has been found in TOTOLINK A3000RU up to 5.9c.5185 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/ExportIbmsConfig.sh of the component IBMS Configuration File Handler. The manipulation leads to impr…

    Toto Link A3000RU
  • Medium 6.3
    CVE-2025-2952

    Bluestar Micro Mall api.php unrestricted upload

    A vulnerability classified as critical was found in Bluestar Micro Mall 1.0. Affected by this vulnerability is an unknown functionality of the file /api/api.php?mod=upload&type=1. The manipulation of the argument File leads to unrestricted upload. The attack …

    Bluestar Micro Mall
  • Medium 6.3
    CVE-2025-2951

    Bluestar Micro Mall data.php sql injection

    A vulnerability classified as critical has been found in Bluestar Micro Mall 1.0. Affected is an unknown function of the file /api/data.php. The manipulation of the argument Search leads to sql injection. It is possible to launch the attack remotely. The expl…

    Bluestar Micro Mall
  • Medium 6.3
    CVE-2025-1861

    Stream HTTP wrapper truncates redirect location to 1024 bytes

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the loca…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2025-1736

    Stream HTTP wrapper header check might omit basic auth header

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2025-1734

    Streams HTTP wrapper does not fail for headers with invalid name and no colon

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse appl…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2025-1219 Public exploit

    libxml streams use wrong content-type header when requesting a redirected resource

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the reques…

    PHP Group PHP php7.4 php8.1 Debian Ubuntu Azure Linux Alpine