Web Application Detections Published in March 2025

In March, Qualys Web Application Scanning released QIDs targeting vulnerabilities in several widely used software products and frameworks, including, 

Next.js, MITRE – Caldera, WordPress, Wazuh Server, JSONPath Plus, GraphQL Mesh, NAKIVO – Backup and Replication, Adobe – ColdFusion, SeaCMS, Joomla! – Core, Joomla! – Sourcerer Extension, Joomla! – ConvertForms Extension, Kibana, Apache – Pinot, Apache – Tomcat, Apache – Ranger, Apache – CloudStack, Apache – Camel, Apache – Nifi, IBM – Aspera Shares, ServiceNow , GitLab – GitLab CE/EE, Wiki.js, Pandora FMS, Zimbra, ClassCMS, Liferay Portal, JetBrains – YouTrack, JetBrains – TeamCity, Jenkins – AnchorChain Plugin, Drupal – Core, Synapse , LiteLLM, Splunk, Vite, PublicCMS, Gunicorn.

The QIDs released to detect the vulnerabilities in the frameworks above are listed below, details about the following QIDs can be found in our knowledge base. Please review reports of the scanned applications for these detections and, if any are identified, follow the steps provided in the knowledge base to ensure applications are protected against the reported vulnerabilities. Resolution of these vulnerabilities as soon as they are detected should be a priority for all organizations. These vulnerabilities can pose security risks if not addressed. Security risks can include breaches, unauthorized access, and various malicious activities.