deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-27404
Published: 2025-03-26
Description: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5; https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3; https://github.com/Icinga/icingaweb2/security/advisories/GHSA-c6pg-h955-wf66
CVE: CVE-2025-28855
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in srcoley Teleport teleport allows Reflected XSS.This issue affects Teleport: from n/a through <= 1.2.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/teleport/vulnerability/wordpress-teleport-plugin-1-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28858
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Maps ap-google-maps allows Reflected XSS.This issue affects Arrow Maps: from n/a through <= 1.0.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ap-google-maps/vulnerability/wordpress-arrow-maps-plugin-1-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28865
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lionelroux WP Colorful Tag Cloud wp-colorful-tag-cloud allows Reflected XSS.This issue affects WP Colorful Tag Cloud: from n/a through <= 2.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-colorful-tag-cloud/vulnerability/wordpress-wp-colorful-tag-cloud-plugin-2-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28869
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shauno NextGEN Gallery Voting nextgen-gallery-voting allows Reflected XSS.This issue affects NextGEN Gallery Voting: from n/a through <= 2.7.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nextgen-gallery-voting/vulnerability/wordpress-nextgen-gallery-voting-plugin-2-7-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28873
Published: 2025-03-26
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Scott Taylor Shuffle shuffle allows Blind SQL Injection.This issue affects Shuffle: from n/a through <= 0.5.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Theme/shuffle/vulnerability/wordpress-shuffle-plugin-0-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-28877
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in m.tiggelaar Key4ce osTicket Bridge key4ce-osticket-bridge allows Reflected XSS.This issue affects Key4ce osTicket Bridge: from n/a through <= 1.4.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/key4ce-osticket-bridge/vulnerability/wordpress-key4ce-osticket-bridge-plugin-1-4-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28880
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jotis Blue Captcha blue-captcha allows Reflected XSS.This issue affects Blue Captcha: from n/a through <= 1.7.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/blue-captcha/vulnerability/wordpress-blue-captcha-plugin-1-7-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28882
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Omnify, Inc. Omnify omnify-widget allows Reflected XSS.This issue affects Omnify: from n/a through <= 2.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/omnify-widget/vulnerability/wordpress-omnify-plugin-2-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28885
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fiverraffiliates Fiverr.com Official Search Box fiverr-official-search-box allows Stored XSS.This issue affects Fiverr.com Official Search Box: from n/a through <= 1.0.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/fiverr-official-search-box/vulnerability/wordpress-fiverr-com-official-search-box-plugin-1-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28889
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in starblank Custom Product Stickers for Woocommerce custom-product-stickers-for-woocommerce allows Reflected XSS.This issue affects Custom Product Stickers for Woocommerce: from n/a through <= 1.9.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-product-stickers-for-woocommerce/vulnerability/wordpress-custom-product-stickers-for-woocommerce-plugin-1-9-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28890
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Lightview Plus lightview-plus allows Reflected XSS.This issue affects Lightview Plus: from n/a through <= 3.1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lightview-plus/vulnerability/wordpress-lightview-plus-plugin-3-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28893
Published: 2025-03-26
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Govind Visual Text Editor visual-text-editor allows Remote Code Inclusion.This issue affects Visual Text Editor: from n/a through <= 1.2.1.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/visual-text-editor/vulnerability/wordpress-visual-text-editor-plugin-1-2-1-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-28898
Published: 2025-03-26
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows SQL Injection.This issue affects WP Multistore Locator: from n/a through <= 2.5.2.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-multi-store-locator/vulnerability/wordpress-wp-multistore-locator-plugin-2-5-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-28899
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toddhuish WP Event Ticketing wpeventticketing allows Reflected XSS.This issue affects WP Event Ticketing: from n/a through <= 1.3.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpeventticketing/vulnerability/wordpress-wp-event-ticketing-plugin-1-3-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28903
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hectorgarrofe Driving Directions ddirections allows Reflected XSS.This issue affects Driving Directions: from n/a through <= 1.4.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ddirections/vulnerability/wordpress-driving-directions-plugin-1-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28911
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gravity2pdf Gravity 2 PDF gf2pdf allows Reflected XSS.This issue affects Gravity 2 PDF: from n/a through <= 3.1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gf2pdf/vulnerability/wordpress-gravity-2-pdf-plugin-3-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28916
Published: 2025-03-26
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rashid Docpro docpro allows PHP Local File Inclusion.This issue affects Docpro: from n/a through <= 2.0.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/docpro/vulnerability/wordpress-docpro-plugin-2-0-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-28917
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crazyloong Custom Smilies custom-smilies-se allows Stored XSS.This issue affects Custom Smilies: from n/a through <= 2.9.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-smilies-se/vulnerability/wordpress-custom-smilies-plugin-2-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28921
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in homejunction SpatialMatch IDX spatialmatch-free-lifestyle-search allows Reflected XSS.This issue affects SpatialMatch IDX: from n/a through <= 3.0.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/spatialmatch-free-lifestyle-search/vulnerability/wordpress-spatialmatch-idx-plugin-3-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28924
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simbul ZenphotoPress zenphotopress allows Reflected XSS.This issue affects ZenphotoPress: from n/a through <= 1.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/zenphotopress/vulnerability/wordpress-zenphotopress-plugin-1-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28928
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Are you robot google recaptcha for wordpress are-you-robot-recaptcha allows Reflected XSS.This issue affects Are you robot google recaptcha for wordpress: from n/a through <= 2.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/are-you-robot-recaptcha/vulnerability/wordpress-are-you-robot-google-recaptcha-for-wordpress-plugin-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28934
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaozh Simple Post Series simple-post-series allows Reflected XSS.This issue affects Simple Post Series: from n/a through <= 2.4.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-post-series/vulnerability/wordpress-simple-post-series-plugin-2-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28935
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Fancybox Plus fancybox-plus allows Reflected XSS.This issue affects Fancybox Plus: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/fancybox-plus/vulnerability/wordpress-fancybox-plus-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28939
Published: 2025-03-26
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in EuroCizia WP Google Calendar Manager wp-gcalendar allows Blind SQL Injection.This issue affects WP Google Calendar Manager: from n/a through <= 2.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-gcalendar/vulnerability/wordpress-wp-google-calendar-manager-plugin-2-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-28942
Published: 2025-03-26
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Trust Payments Trust Payments Gateway for WooCommerce trust-payments-hosted-payment-pages-integration allows SQL Injection.This issue affects Trust Payments Gateway for WooCommerce: from n/a through <= 1.1.4.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/trust-payments-hosted-payment-pages-integration/vulnerability/wordpress-trust-payments-gateway-for-woocommerce-plugin-1-1-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-2819
Published: 2025-03-26
Description: There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-434
References: https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0001.pdf
CVE: CVE-2025-2820
Published: 2025-03-26
Description: An authenticated attacker can compromise the availability of the device via the network
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0002.pdf
CVE: CVE-2025-30524
Published: 2025-03-26
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in origincode Product Catalog displayproduct allows SQL Injection.This issue affects Product Catalog: from n/a through <= 1.0.4.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/displayproduct/vulnerability/wordpress-product-catalog-plugin-1-0-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-27405
Published: 2025-03-26
Description: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5; https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3; https://github.com/Icinga/icingaweb2/security/advisories/GHSA-3x37-fjc3-ch8w
CVE: CVE-2025-27406
Published: 2025-03-26
Description: Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascript. This enables the attacker to act on behalf of the user, if the template is being previewed; and act on behalf of the headless browser, if a report using the template is printed to PDF. This issue has been resolved in version 1.0.3 of Icinga Reporting. As a workaround, review all templates and remove suspicious settings.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-918
References: https://github.com/Icinga/icingaweb2-module-reporting/releases/tag/v1.0.3; https://github.com/Icinga/icingaweb2-module-reporting/security/advisories/GHSA-7qvq-54vm-r7hx
CVE: CVE-2025-2098
Published: 2025-03-26
Description: Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects Fast CAD Reader in possibly all versions since the vendor has not responded to our messages. The tested version was 4.1.5
CWE: CWE-732
References: https://apps.apple.com/pl/app/fast-cad-reader/id[PII_REDACTED]; https://cert.pl/en/posts/2025/03/CVE-2025-2098/
CVE: CVE-2025-2783
Published: 2025-03-26
Description: Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
CVSS Score: 8.3 (HIGH)
References: https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html; https://issues.chromium.org/issues/405143032; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2783
CVE: CVE-2025-2825
Published: 2025-03-26
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2025-31161. Reason: This Record is a reservation duplicate of CVE-2025-31161. Notes: All CVE users should reference CVE-2025-31161 instead of this Record. All references and descriptions in this Record have been removed to prevent accidental usage.
CVE: CVE-2025-27609
Published: 2025-03-26
Description: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a request that, once transmitted to a victim's Icinga Web, allows to embed arbitrary Javascript into it and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings. Any modern browser with a working CORS implementation also sufficiently guards against the vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5; https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3; https://github.com/Icinga/icingaweb2/security/advisories/GHSA-5cjw-fwjc-8j38
CVE: CVE-2025-30164
Published: 2025-03-26
Description: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5; https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3; https://github.com/Icinga/icingaweb2/security/advisories/GHSA-8r73-6686-wv8q
CVE: CVE-2025-30217
Published: 2025-03-26
Description: Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Versions 14.93.2 and 15.55.0 contain a patch for the issue. No known workarounds are available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/frappe/frappe/security/advisories/GHSA-6phg-4wmq-h5h3
CVE: CVE-2025-30225
Published: 2025-03-26
Description: Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a burst of malformed transformations. When making many malformed transformation requests at once, at some point, all assets are served as 403. This causes denial of assets for all policies of Directus, including Admin and Public. Version 12.0.1 of the `@directus/storage-driver-s3` package, corresponding to version 11.5.0 of Directus, fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/directus/directus/security/advisories/GHSA-j8xj-7jff-46mx
CVE: CVE-2025-30350
Published: 2025-03-26
Description: Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a burst of HEAD requests. Some tools use Directus to sync content and assets, and some of those tools use the HEAD method to check the existence of files. When making many HEAD requests at once, at some point, all assets are eventually served as 403. This causes denial of assets for all policies of Directus, including Admin and Public. Version 12.0.1 of the `@directus/storage-driver-s3` package, corresponding to version 11.5.0 of Directus, fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/directus/directus/security/advisories/GHSA-rv78-qqrq-73m5
CVE: CVE-2024-41643
Published: 2025-03-26
Description: An issue in Arris NVG443B 9.3.0h3d36 allows a physically proximate attacker to execute arbitrary code via the cshell login component.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: https://gavpherk.github.io/GavinKelsey/
CVE: CVE-2025-2499
Published: 2025-03-26
Description: Client side access control bypass in the permission component in 
Devolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to bypass certain permission restrictions—specifically View Password, Edit Asset, and Edit Permissions by performing specific actions. 

This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://devolutions.net/security/advisories/DEVO-2025-0005/
CVE: CVE-2025-2528
Published: 2025-03-26
Description: Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to 
use a configuration different from the one mandated by the system administrators.





This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
CVSS Score: 3.6 (LOW)
CWE: CWE-285
References: https://devolutions.net/security/advisories/DEVO-2025-0005/
CVE: CVE-2025-2562
Published: 2025-03-26
Description: Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without generating a corresponding log event, via the use of the autotyping functionality.







This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-778
References: https://devolutions.net/security/advisories/DEVO-2025-0005/