cisa.gov | Bulletins
Follow
Vulnerability Summary for the Week of March 31, 2025
This text summarizes several high-severity vulnerabilities found in various software products. These vulnerabilities range from Cross-Site Request Forgery (CSRF) and SQL Injection to Remote Code Inclusion and privilege escalation. Aboobacker's AB Google Map Travel and AdminGeekZ's Varnish WordPress are affected by CSRF. adamskaat's Countdown & Clock has a Path Traversal vulnerability, and its WordPress plugin has a Local File Inclusion issue. Ads by WPQuads is vulnerable to SQL Injection and missing authorization checks. ageerle's ruoyi-ai has improper authorization issues that can be exploited remotely. aitool's content writing assistant is susceptible to Blind SQL Injection. Aiven-extras has a privilege escalation vulnerability that allows becoming a superuser. Apple's macOS and iPadOS have multiple vulnerabilities, including sandbox escapes, memory corruption, and privilege escalation, addressed in recent updates. AMD Ryzen AI Software has integer overflow issues and incorrect default permissions. Alex Prokopenko's Just Post Preview Widget has a PHP Local File Inclusion vulnerability, and Angelo Mandato's Blubrry PowerPress plugin has a Cross-site Scripting issue.