CVEs published February 3, 2025
185 CVEs were published on February 3, 2025: 13 critical, 100 high. 3 are now in CISA KEV.
- Published
- 185
- Critical
- 13
- High
- 100
- Medium
- 69
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 31
Most affected products
- Qualcomm Snapdragon
- 24
- MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…
- 8
- LabRedesCefetRJ WeGIA
- 6
- imithemes Eventer - WordPress Event & Booking Manager Plugin
- 3
- Advantive VeraCore
- 2
- backdropcms backdrop
- 2
- CyberArk Privileged Access Manager
- 2
- Enalean tuleap
- 2
- MediaTek MT7615, MT7622, MT7663, MT7915, MT7916, MT7981, MT…
- 2
- wazuh · github.com/wazuh/wazuh
- 2
Critical 13
- CVE-2025-24901SQL Injection endpoint 'deletar_permissao.php' parameter 'c', 'a', 'r' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-24902SQL Injection endpoint 'salvar_cargo.php' parameter 'id_cargo' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-24905SQL Injection endpoint 'get_codigobarras_cobranca.php' parameter 'codigo' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-24906SQL Injection endpoint 'get_detalhes_cobranca.php' parameter 'codigo' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-24957SQL Injection endpoint 'get_detalhes_socio.php' parameter 'id_socio' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-24958SQL Injection endpoint 'salvar_tag.php' parameter 'id_tag' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-24370Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypassadamghill django-unicorn · django-unicorn
- CVE-2024-45569Improper Validation of Array Index in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-57098Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter.
- CVE-2024-57099ClassCMS v4.8 has a code execution vulnerability.
- CVE-2024-57450ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function.
- CVE-2024-57968Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessibleAdvantive VeraCore
- CVE-2025-22978eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module.
High 100
- CVE-2025-1003HP Anyware Agent for Linux – Potential Authentication BypassHP Anyware Linux Agent
- CVE-2024-35177Improper Access Control in wazuh-agentwazuh · github.com/wazuh/wazuh
- CVE-2025-24371Malicious peer can make node stuck in blocksync in github.com/cometbft/cometbftcometbft · github.com/cometbft/cometbft
- CVE-2025-24899Disclosure of Sensitive User Information via API in reNgineyogeshojha rengine
- CVE-2025-24962Command Injection in reNgineyogeshojha rengine
- CVE-2025-24960Missing Input validation for filename in backups endpoint in JellystatCyferShepard Jellystat
- CVE-2024-12511SMB/FTP Address Book Scan Pass-back attackXerox Versalink B400 · Xerox Versalink B405 +15
- CVE-2024-12859BoomBox Theme Extensions <= 1.8.0 - Authenticated (Contributor+) Local File Inclusion via ShortcodePX-lab BoomBox Theme Extensions
- CVE-2024-56161Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicAMD EPYC™ 7001 Series · AMD EPYC™ 7002 Series +2
- CVE-2024-49843Improper Validation of Array Index in Graphics_LinuxQualcomm Snapdragon
- CVE-2024-49840Use of Out-of-range Pointer Offset in WLAN Windows HostQualcomm Snapdragon
- CVE-2024-49839Buffer Over-read in WLAN Host CmnQualcomm Snapdragon
- CVE-2024-49838Buffer Over-read in WLAN HOSTQualcomm Snapdragon
- CVE-2024-49837Improper Validation of Array Index in Automotive OS PlatformQualcomm Snapdragon
- CVE-2024-49834Improper Validation of Array Index in CameraQualcomm Snapdragon
- CVE-2024-49833Improper Validation of Array Index in CameraQualcomm Snapdragon
- CVE-2024-49832Improper Validation of Array Index in CameraQualcomm Snapdragon
- CVE-2024-45584Untrusted Pointer Dereference in Automotive Android OSQualcomm Snapdragon
- CVE-2024-45582Improper Validation of Array Index in Camera DriverQualcomm Snapdragon
- CVE-2024-45573Use of Out-of-range Pointer Offset in DisplayQualcomm Snapdragon
- CVE-2024-45571Use After Free in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-45561Use After Free in Windows WLAN HostQualcomm Snapdragon
- CVE-2024-45560Time-of-check Time-of-use (TOCTOU) Race Condition in CameraQualcomm Snapdragon
- CVE-2024-38420Improper Input Validation in HypervisorQualcomm Snapdragon
- CVE-2024-38418Time-of-check Time-of-use (TOCTOU) Race Condition in Camera LinuxQualcomm Snapdragon
- CVE-2024-38404Buffer Over-read in Multi Mode Call ProcessorQualcomm Snapdragon
- CVE-2025-24661WordPress Taxi Booking Manager for WooCommerce plugin <= 1.1.8 - PHP Object Injection vulnerabilitymagepeopleteam Taxi Booking Manager for WooCommerce
- CVE-2025-23984WordPress Dynamic URL SEO plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitybrainvireinfo Dynamic URL SEO
- CVE-2025-22775WordPress Catalog Importer, Scraper & Crawler Plugin <= 5.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityidiatech Catalog Importer, Scraper & Crawler
- CVE-2025-22704WordPress Signature plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityAbinav Thakuri WordPress Signature
- CVE-2025-22703WordPress Forge – Front-End Page Builder plugin <= 1.4.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilitymanuelvicedo Forge – Front-End Page Builder
- CVE-2025-22693WordPress Contest Gallery plugin <= 25.1.0 - SQL Injection vulnerabilityWasiliy Strecker / ContestGallery developer Contest Gallery
- CVE-2025-22691WordPress WP Travel plugin <= 10.1.3 - SQL Injection vulnerabilityWP Travel
- CVE-2025-22690WordPress DigiTimber cPanel Integration plugin <= 1.4.6 - CSRF to Stored XSS vulnerabilityDigiTimber cPanel Integration
- CVE-2025-22688WordPress Unlimited Page Sidebars plugin <= 0.2.6 - CSRF to Stored XSS vulnerabilityEderson Peka Unlimited Page Sidebars
- CVE-2025-22685WordPress Tags to Keywords plugin <= 1.0.1 - CSRF to Stored XSS vulnerabilityCheGevara29 Tags to Keywords
- CVE-2025-22684WordPress WP BASE Booking plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerabilityHakan Ozevin WP BASE Booking
- CVE-2025-22682WordPress Hesabfa Accounting Plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilitySaeed Sattar Beglou Hesabfa Accounting
- CVE-2025-22679WordPress Job Board Manager Plugin <= 2.1.61 - Reflected Cross Site Scripting (XSS) vulnerabilityPickPlugins Job Board Manager
- CVE-2024-43333WordPress Admin and Site Enhancements (ASE) Pro Plugin <= 7.6.2.1 - Privilege Escalation vulnerabilityNotFound Admin and Site Enhancements (ASE) Pro
- CVE-2025-24707WordPress Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin <= 2.7.7.24 - Reflected Cross Site Scripting (XSS) vulnerabilitygt3themes Photo Gallery
- CVE-2025-24684WordPress Media Downloader Plugin <= 0.4.7.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEderson Peka Media Downloader
- CVE-2025-24676WordPress Custom WP Store Locator plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerabilityumangmetatagg Custom WP Store Locator
- CVE-2025-24660WordPress Simple Membership Custom Messages Plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerabilitywp.insider Simple Membership Custom Messages
- CVE-2025-24656WordPress Realtyna Provisioning Plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityRealtyna Provisioning
- CVE-2025-24646WordPress XML for Avito Plugin <= 2.5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityicopydoc XML for Avito
- CVE-2025-24631WordPress BP Email Assign Templates Plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityshanebp BP Email Assign Templates
- CVE-2025-24630WordPress Sikshya LMS Plugin <= 0.0.21 - Reflected Cross Site Scripting (XSS) vulnerabilityMantraBrain Sikshya LMS
- CVE-2025-24629WordPress Import Excel to Gravity Forms Plugin <= 1.18 - Reflected Cross Site Scripting (XSS) vulnerabilitywpgear Import Excel to Gravity Forms
- CVE-2025-24620WordPress AIO Shortcodes plugin <= 1.3 - Stored Cross Site Scripting (XSS) vulnerabilityhkharpreetkumar1 AIO Shortcodes
- CVE-2025-24605WordPress WOLF plugin <= 1.0.8.5 - Path Traversal vulnerabilityRealMag777 WOLF
- CVE-2025-24576WordPress Landing Page Cat plugin <= 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerabilityfatcatapps Landing Page Cat
- CVE-2025-24574WordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.6.9 - Reflected Cross Site Scripting (XSS) vulnerabilityPepro Dev. Group PeproDev WooCommerce Receipt Uploader
- CVE-2025-24569WordPress PDF Generator Addon for Elementor Page Builder plugin <= 1.7.5 - Arbitrary File Read vulnerabilityRedefiningTheWeb PDF Generator Addon for Elementor Page Bui…
- CVE-2025-24559WordPress WP Mailster plugin <= 1.8.15.0 - Reflected Cross Site Scripting (XSS) vulnerabilitybrandtoss WP Mailster
- CVE-2025-24557WordPress PlainInventory plugin <= 3.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityplainware PlainInventory
- CVE-2025-24556WordPress MooWoodle plugin <= 3.2.4 - Sensitive Data Exposure vulnerabilityDualCube MooWoodle
- CVE-2025-24545WordPress BSK Forms Validation plugin <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerabilitybannersky BSK Forms Validation
- CVE-2025-24544WordPress Bitcoin and Altcoin Wallets plugin <= 6.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilitydashed-slug.net Bitcoin and Altcoin Wallets
- CVE-2025-24541WordPress DK White Label plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitydinamiko DK White Label
- CVE-2025-24536WordPress ThriveDesk plugin <= 2.0.6 - Reflected Cross Site Scripting (XSS) vulnerabilityThriveDesk
- CVE-2025-23923WordPress Lockets Plugin <= 0.999 - Reflected Cross Site Scripting (XSS) vulnerabilitywackey Lockets
- CVE-2025-23920WordPress ApplicantPro Plugin <= 1.3.9 - Reflected Cross Site Scripting (XSS) vulnerabilitySourcing Team ApplicantPro
- CVE-2025-23819WordPress WP Cloud plugin <= 1.4.3 - Arbitrary File Deletion vulnerabilityMarco Milesi WP Cloud
- CVE-2025-23799WordPress .TUBE Video Curator Plugin <= 1.1.9 - Reflected Cross Site Scripting (XSS) vulnerabilitytubegtld .TUBE Video Curator
- CVE-2025-23755WordPress PAFacile plugin <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilitytosend.it PAFacile
- CVE-2025-23685WordPress RomanCart On WordPress plugin <= 0.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityWebTechGlobal RomanCart
- CVE-2025-23614WordPress WordPress Additional Logins plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityniksudan WordPress Additional Logins
- CVE-2025-23599WordPress eMarksheet plugin <= 5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityAarvansh Infotech eMarksheet
- CVE-2025-23594WordPress Google Map With Fancybox plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityUzzal Mondal Google Map With Fancybox
- CVE-2025-23593WordPress EmailPress plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitykvvaradha EmailPress
- CVE-2025-23591WordPress blu Logistics plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityblulogistics1 blu Logistics
- CVE-2025-23590WordPress Dezdy plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityDezdy.com Dezdy
- CVE-2025-23588WordPress WOW Best CSS Compiler plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilitybaonguyenyam WOW Best CSS Compiler
- CVE-2025-23582WordPress Bulk Categories Assign plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityHaider Ali Bulk Categories Assign
- CVE-2025-23491WordPress VSTEMPLATE Creator plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityVikash Srivastava VSTEMPLATE Creator
- CVE-2025-24781WordPress WPJobBoard plugin <= 5.10.1 - Reflected Cross Site Scripting (XSS) vulnerabilityNotFound WPJobBoard
- CVE-2025-0015Mali GPU Kernel Driver allows improper GPU processing operationsArm Valhall GPU Kernel Driver · Arm 5th Gen GPU Architectur…
- CVE-2024-10395net: lib: http_server: Buffer Under-readzephyrproject-rtos Zephyr
- CVE-2025-20641In DA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…
- CVE-2025-20637In network HW, there is a possible system hang due to an uncaught exception.MediaTek MT7981, MT7986
- CVE-2025-20634In Modem, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2737, MT6813, MT6835, MT6835T, MT6878, MT6878M,…
- CVE-2025-20631In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT7615, MT7622, MT7663, MT7915, MT7916, MT7981, MT…
- CVE-2025-20632In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT7615, MT7622, MT7663, MT7915, MT7916, MT7981, MT…
- CVE-2025-20633In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT7603, MT7615, MT7622, MT7915
- CVE-2023-52163Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection.
- CVE-2024-34896An issue in Nedis SmartLife Video Doorbell (WIFICDP10GY), Nedis SmartLife IOS v1.4.0 causes users who are disconnected from a previous peer-
- CVE-2024-34897Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability.
- CVE-2024-56898Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less.
- CVE-2024-56901A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers t
- CVE-2024-56902Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account in
- CVE-2024-56903Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionali
- CVE-2024-56921An issue was discovered in Open5gs v2.7.2.
- CVE-2024-57238Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/proc_get endpoint.
- CVE-2024-57451ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to
- CVE-2024-57452ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete
- CVE-2024-57669Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive information via the Bac
- CVE-2025-22918Polycom RealPresence Group 500 <=20 has Insecure Permissions due to automatically loaded cookies.
- CVE-2025-25064SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 d
- CVE-2025-25066nDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in lib/ndpi_cache.c.ntop nDPI
Medium, low and unrated 72
- CVE-2025-0148Zoom Jenkins Marketplace plugin - Missing Password Field MaskingZoom Communications Zoom Jenkins Marketplace plugin · io.je…
- CVE-2024-47770Ability to view Agent list with no privilege access in wazuh-dashboardwazuh · github.com/wazuh/wazuh
- CVE-2025-22129Initial effort field does not respect field permissions in the Taskboard REST card representation in TuleapEnalean tuleap
- CVE-2025-24029Artifact permissions are not verified in the Cross Tracker Search widget in TuleapEnalean tuleap
- CVE-2025-23210Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheetPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2025-24959Environment Variable Injection for dotenv API in zxgoogle zx · zx
- CVE-2025-24961Insecure path traversal in filesystem and filesystem-nio2 storage backends in org.gaul S3Proxygaul s3proxy · org.gaul:s3proxy
- CVE-2024-11134Eventer <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Exportimithemes Eventer - WordPress Event & Booking Manager Plugin
- CVE-2024-11132Eventer <= 3.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeimithemes Eventer - WordPress Event & Booking Manager Plugin
- CVE-2024-11133Eventer <= 3.9.9.5 - Missing Authorization to Unauthenticated Event Ticket Downloadimithemes Eventer - WordPress Event & Booking Manager Plugin
- CVE-2024-12510LDAP Authentication Sever Pass-back attackXerox Versalink B400 · Xerox Versalink B405 +15
- CVE-2025-24898rust openssl ssl::select_next_proto use after freesfackler rust-openssl · openssl
- CVE-2024-38417Buffer Over-read in Automotive MultimediaQualcomm Snapdragon
- CVE-2024-38416Buffer Over-read in AudioQualcomm Snapdragon
- CVE-2024-38414Buffer Over-read in Computer VisionQualcomm Snapdragon
- CVE-2024-38413Improper Input Validation in Computer VisionQualcomm Snapdragon
- CVE-2024-38412Use After Free in Computer VisionQualcomm Snapdragon
- CVE-2024-38411Use After Free in Computer VisionQualcomm Snapdragon
- CVE-2025-22701WordPress Traveler Layout Essential For Elementor plugin < 1.4 - Server Side Request Forgery (SSRF) vulnerabilityshinetheme Traveler Layout Essential For Elementor
- CVE-2025-22695WordPress Nirweb support plugin <= 3.0.3 - Broken Access Control vulnerabilityNirWp Team Nirweb support
- CVE-2025-22694WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerabilityDotstore Hide Shipping Method For WooCommerce
- CVE-2025-22686WordPress CF7 Google Sheets Connector plugin <= 5.0.17 - Broken Access Control vulnerabilityWesternDeal CF7 Google Sheets Connector
- CVE-2025-22683WordPress NotificationX plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper NotificationX
- CVE-2025-22681WordPress Content Cloner plugin <= 1.0.1 - Broken Access Control vulnerabilityXfinitysoft Content Cloner
- CVE-2025-22677WordPress Uix Shortcodes plugin <= 2.0.3 - Arbitrary Shortcode Execution vulnerabilityUIUX Lab Uix Shortcodes
- CVE-2025-22292WordPress Powerful Auto Chat plugin <= 1.9.8 - Cross Site Scripting (XSS) vulnerabilityFelipe Peixoto Powerful Auto Chat
- CVE-2025-22260WordPress Meta Tag Manager plugin <= 3.1 - Broken Access Control vulnerabilityMarcus (aka @msykes) Meta Tag Manager
- CVE-2024-50500WordPress Phlox Core Elements plugin <= 2.17.4 - Broken Access Control vulnerabilityaverta Shortcodes and extra features for Phlox theme
- CVE-2025-24697WordPress Image Gallery – Responsive Photo Gallery plugin <= 1.0.5 - Broken Access Control vulnerabilityRealwebcare Image Gallery – Responsive Photo Gallery
- CVE-2025-24643WordPress WPGuppy plugin <= 1.1.0 - Broken Authentication vulnerabilityAmentoTech Private Limited WPGuppy
- CVE-2025-24642WordPress Setup Default Featured Image plugin <= 1.2 - Broken Access Control vulnerabilitytheme funda Setup Default Featured Image
- CVE-2025-24639WordPress Korea for WooCommerce plugin <= 1.1.11 - Sensitive Data Exposure vulnerabilityGreys Korea for WooCommerce
- CVE-2025-23747WordPress Awesome Timeline plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityNitesh Awesome Timeline
- CVE-2025-23581WordPress Demo User DZS plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilitydigitalzoomstudio Demo User DZS
- CVE-2025-23561WordPress MLL Audio Player MP3 Ajax plugin <= 0.7 - Cross Site Scripting (XSS) vulnerabilityrobertkay MLL Audio Player MP3 Ajax
- CVE-2025-23527WordPress WC Wallet plugin <= 2.2.0 - Arbitrary Content Deletion vulnerabilityhemnathmouli WC Wallet
- CVE-2024-6790Mali GPU Kernel Driver can cause the whole system to become unresponsiveArm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1
- CVE-2024-13347Essential WP Real Estate <= 1.1.3 - Reflected XSSEssential WP Real Estate
- CVE-2024-20147In Bluetooth FW, there is a possible reachable assertion due to improper exception handling.MediaTek MT2737, MT3603, MT6835, MT6878, MT6886, MT6897, MT…
- CVE-2025-20643In DA, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…
- CVE-2025-20642In DA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…
- CVE-2025-20640In DA, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…
- CVE-2025-20639In DA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…
- CVE-2025-20638In DA, there is a possible read of uninitialized heap data due to uninitialized data.MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…
- CVE-2024-20142In V5 DA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…
- CVE-2024-20141In V5 DA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…
- CVE-2025-20636In secmem, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…
- CVE-2025-20635In V6 DA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT…
- CVE-2025-0974MaxD Lightning Module deserializationMaxD Lightning Module
- CVE-2025-0973CmsEasy index.php backAll_action path traversalCmsEasy
- CVE-2025-0972Zenvia Movidesk New Ticket cross site scriptingZenvia Movidesk
- CVE-2023-52164access_device.cgi on Digiever DS-2105 Pro 3.1.0.71-11 devices allows arbitrary file read.
- CVE-2024-36437The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (wi
- CVE-2024-44449Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive information via the msg para
- CVE-2024-50656itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php.
- CVE-2024-53942An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices.
- CVE-2024-53943An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices.
- CVE-2024-54840PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues CyberArk Privileged Access Manager
- CVE-2024-55456lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_celllunasvg
- CVE-2024-56946Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the server from accepting
- CVE-2024-57004Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email
- CVE-2024-57097ClassCMS 4.8 is vulnerable to Cross Site Scripting (XSS) in class/admin/channel.php.
- CVE-2024-57175A Stored Cross-Site Scripting (XSS) vulnerability was identified in the PHPGURUKUL Online Birth Certificate System v1.0 via the profile name
- CVE-2024-57237Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to Cross Site Scripting (XSS) in the /reqproc/proc_get endpoint.
- CVE-2024-57498Cross Site Scripting vulnerability in sayski ForestBlog 20241223 allows a remote attacker to escalate privileges via the article editing fun
- CVE-2024-57522SourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in Users.php.
- CVE-2024-57966libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.KDE ark
- CVE-2024-57967PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 has potentially elevated privileges in LDAP mCyberArk Privileged Access Manager
- CVE-2025-25062An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.backdropcms backdrop
- CVE-2025-25063An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.backdropcms backdrop
- CVE-2025-25065SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 all
- CVE-2025-25181A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL Advantive VeraCore