# CVEs published 2025-02-03

185 CVEs were published on February 3, 2025: 13 critical, 100 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2025-1003](https://cve.now/CVE-2025-1003.md): HP Anyware Agent for Linux – Potential Authentication Bypass (CVSS 8.5, HP Anyware Linux Agent)
- [CVE-2025-0148](https://cve.now/CVE-2025-0148.md): Zoom Jenkins Marketplace plugin - Missing Password Field Masking (CVSS 2.6, Zoom Communications Zoom Jenkins Marketplace plugin · io.je…)
- [CVE-2025-24901](https://cve.now/CVE-2025-24901.md): SQL Injection endpoint 'deletar\_permissao.php' parameter 'c', 'a', 'r' in WeGIA (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-24902](https://cve.now/CVE-2025-24902.md): SQL Injection endpoint 'salvar\_cargo.php' parameter 'id\_cargo' in WeGIA (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-24905](https://cve.now/CVE-2025-24905.md): SQL Injection endpoint 'get\_codigobarras\_cobranca.php' parameter 'codigo' in WeGIA (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-24906](https://cve.now/CVE-2025-24906.md): SQL Injection endpoint 'get\_detalhes\_cobranca.php' parameter 'codigo' in WeGIA (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-24957](https://cve.now/CVE-2025-24957.md): SQL Injection endpoint 'get\_detalhes\_socio.php' parameter 'id\_socio' in WeGIA (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-24958](https://cve.now/CVE-2025-24958.md): SQL Injection endpoint 'salvar\_tag.php' parameter 'id\_tag' in WeGIA (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2024-35177](https://cve.now/CVE-2024-35177.md): Improper Access Control in wazuh-agent (CVSS 7.8, wazuh · github.com/wazuh/wazuh)
- [CVE-2024-47770](https://cve.now/CVE-2024-47770.md): Ability to view Agent list with no privilege access in wazuh-dashboard (CVSS 4.6, wazuh · github.com/wazuh/wazuh)
- [CVE-2025-22129](https://cve.now/CVE-2025-22129.md): Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap (CVSS 4.3, Enalean tuleap)
- [CVE-2025-24029](https://cve.now/CVE-2025-24029.md): Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap (CVSS 5.3, Enalean tuleap)
- [CVE-2025-24371](https://cve.now/CVE-2025-24371.md): Malicious peer can make node stuck in blocksync in github.com/cometbft/cometbft (CVSS 7.1, cometbft · github.com/cometbft/cometbft)
- [CVE-2025-23210](https://cve.now/CVE-2025-23210.md): Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet (CVSS 4.8, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2025-24370](https://cve.now/CVE-2025-24370.md): Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass (CVSS 9.3, adamghill django-unicorn · django-unicorn)
- [CVE-2025-24899](https://cve.now/CVE-2025-24899.md): Disclosure of Sensitive User Information via API in reNgine (CVSS 7.1, yogeshojha rengine)
- [CVE-2025-24962](https://cve.now/CVE-2025-24962.md): Command Injection in reNgine (CVSS 8.7, yogeshojha rengine)
- [CVE-2025-24959](https://cve.now/CVE-2025-24959.md): Environment Variable Injection for dotenv API in zx (CVSS 1.0, google zx · zx)
- [CVE-2025-24960](https://cve.now/CVE-2025-24960.md): Missing Input validation for filename in backups endpoint in Jellystat (CVSS 8.7, CyferShepard Jellystat)
- [CVE-2025-24961](https://cve.now/CVE-2025-24961.md): Insecure path traversal in filesystem and filesystem-nio2 storage backends in org.gaul S3Proxy (CVSS 6.0, gaul s3proxy · org.gaul:s3proxy)
- [CVE-2024-12511](https://cve.now/CVE-2024-12511.md): SMB/FTP Address Book Scan Pass-back attack (CVSS 7.6, Xerox Versalink B400 · Xerox Versalink B405 +15)
- [CVE-2024-12859](https://cve.now/CVE-2024-12859.md): BoomBox Theme Extensions \<= 1.8.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode (CVSS 8.8, PX-lab BoomBox Theme Extensions)
- [CVE-2024-11134](https://cve.now/CVE-2024-11134.md): Eventer \<= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export (CVSS 4.3, imithemes Eventer - WordPress Event & Booking Manager Plugin)
- [CVE-2024-11132](https://cve.now/CVE-2024-11132.md): Eventer \<= 3.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, imithemes Eventer - WordPress Event & Booking Manager Plugin)
- [CVE-2024-11133](https://cve.now/CVE-2024-11133.md): Eventer \<= 3.9.9.5 - Missing Authorization to Unauthenticated Event Ticket Download (CVSS 5.3, imithemes Eventer - WordPress Event & Booking Manager Plugin)
- [CVE-2024-12510](https://cve.now/CVE-2024-12510.md): LDAP Authentication Sever Pass-back attack (CVSS 6.7, Xerox Versalink B400 · Xerox Versalink B405 +15)
- [CVE-2025-24898](https://cve.now/CVE-2025-24898.md): rust openssl ssl::select\_next\_proto use after free (CVSS 6.3, sfackler rust-openssl · openssl)
- [CVE-2024-56161](https://cve.now/CVE-2024-56161.md): Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malic (CVSS 7.2, AMD EPYC™ 7001 Series · AMD EPYC™ 7002 Series +2)
- [CVE-2024-49843](https://cve.now/CVE-2024-49843.md): Improper Validation of Array Index in Graphics\_Linux (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-49840](https://cve.now/CVE-2024-49840.md): Use of Out-of-range Pointer Offset in WLAN Windows Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-49839](https://cve.now/CVE-2024-49839.md): Buffer Over-read in WLAN Host Cmn (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2024-49838](https://cve.now/CVE-2024-49838.md): Buffer Over-read in WLAN HOST (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2024-49837](https://cve.now/CVE-2024-49837.md): Improper Validation of Array Index in Automotive OS Platform (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-49834](https://cve.now/CVE-2024-49834.md): Improper Validation of Array Index in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-49833](https://cve.now/CVE-2024-49833.md): Improper Validation of Array Index in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-49832](https://cve.now/CVE-2024-49832.md): Improper Validation of Array Index in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45584](https://cve.now/CVE-2024-45584.md): Untrusted Pointer Dereference in Automotive Android OS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45582](https://cve.now/CVE-2024-45582.md): Improper Validation of Array Index in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45573](https://cve.now/CVE-2024-45573.md): Use of Out-of-range Pointer Offset in Display (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45571](https://cve.now/CVE-2024-45571.md): Use After Free in WLAN Host Communication (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45569](https://cve.now/CVE-2024-45569.md): Improper Validation of Array Index in WLAN Host Communication (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2024-45561](https://cve.now/CVE-2024-45561.md): Use After Free in Windows WLAN Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45560](https://cve.now/CVE-2024-45560.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-38420](https://cve.now/CVE-2024-38420.md): Improper Input Validation in Hypervisor (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2024-38418](https://cve.now/CVE-2024-38418.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Linux (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-38417](https://cve.now/CVE-2024-38417.md): Buffer Over-read in Automotive Multimedia (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2024-38416](https://cve.now/CVE-2024-38416.md): Buffer Over-read in Audio (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2024-38414](https://cve.now/CVE-2024-38414.md): Buffer Over-read in Computer Vision (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2024-38413](https://cve.now/CVE-2024-38413.md): Improper Input Validation in Computer Vision (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2024-38412](https://cve.now/CVE-2024-38412.md): Use After Free in Computer Vision (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2024-38411](https://cve.now/CVE-2024-38411.md): Use After Free in Computer Vision (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2024-38404](https://cve.now/CVE-2024-38404.md): Buffer Over-read in Multi Mode Call Processor (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-24661](https://cve.now/CVE-2025-24661.md): WordPress Taxi Booking Manager for WooCommerce plugin \<= 1.1.8 - PHP Object Injection vulnerability (CVSS 8.8, magepeopleteam Taxi Booking Manager for WooCommerce)
- [CVE-2025-23984](https://cve.now/CVE-2025-23984.md): WordPress Dynamic URL SEO plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, brainvireinfo Dynamic URL SEO)
- [CVE-2025-22775](https://cve.now/CVE-2025-22775.md): WordPress Catalog Importer, Scraper & Crawler Plugin \<= 5.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, idiatech Catalog Importer, Scraper & Crawler)
- [CVE-2025-22704](https://cve.now/CVE-2025-22704.md): WordPress Signature plugin \<= 0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Abinav Thakuri WordPress Signature)
- [CVE-2025-22703](https://cve.now/CVE-2025-22703.md): WordPress Forge – Front-End Page Builder plugin \<= 1.4.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, manuelvicedo Forge – Front-End Page Builder)
- [CVE-2025-22701](https://cve.now/CVE-2025-22701.md): WordPress Traveler Layout Essential For Elementor plugin \< 1.4 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, shinetheme Traveler Layout Essential For Elementor)
- [CVE-2025-22695](https://cve.now/CVE-2025-22695.md): WordPress Nirweb support plugin \<= 3.0.3 - Broken Access Control vulnerability (CVSS 4.3, NirWp Team Nirweb support)
- [CVE-2025-22694](https://cve.now/CVE-2025-22694.md): WordPress Hide Shipping Method For WooCommerce plugin \<= 1.5.1 - Broken Access Control vulnerability (CVSS 4.3, Dotstore Hide Shipping Method For WooCommerce)
- [CVE-2025-22693](https://cve.now/CVE-2025-22693.md): WordPress Contest Gallery plugin \<= 25.1.0 - SQL Injection vulnerability (CVSS 7.6, Wasiliy Strecker / ContestGallery developer Contest Gallery)
- [CVE-2025-22691](https://cve.now/CVE-2025-22691.md): WordPress WP Travel plugin \<= 10.1.3 - SQL Injection vulnerability (CVSS 7.6, WP Travel)
- [CVE-2025-22690](https://cve.now/CVE-2025-22690.md): WordPress DigiTimber cPanel Integration plugin \<= 1.4.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, DigiTimber cPanel Integration)
- [CVE-2025-22688](https://cve.now/CVE-2025-22688.md): WordPress Unlimited Page Sidebars plugin \<= 0.2.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ederson Peka Unlimited Page Sidebars)
- [CVE-2025-22686](https://cve.now/CVE-2025-22686.md): WordPress CF7 Google Sheets Connector plugin \<= 5.0.17 - Broken Access Control vulnerability (CVSS 5.3, WesternDeal CF7 Google Sheets Connector)
- [CVE-2025-22685](https://cve.now/CVE-2025-22685.md): WordPress Tags to Keywords plugin \<= 1.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, CheGevara29 Tags to Keywords)
- [CVE-2025-22684](https://cve.now/CVE-2025-22684.md): WordPress WP BASE Booking plugin \<= 5.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Hakan Ozevin WP BASE Booking)
- [CVE-2025-22683](https://cve.now/CVE-2025-22683.md): WordPress NotificationX plugin \<= 2.9.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPDeveloper NotificationX)
- [CVE-2025-22682](https://cve.now/CVE-2025-22682.md): WordPress Hesabfa Accounting Plugin \<= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Saeed Sattar Beglou Hesabfa Accounting)
- [CVE-2025-22681](https://cve.now/CVE-2025-22681.md): WordPress Content Cloner plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 4.3, Xfinitysoft Content Cloner)
- [CVE-2025-22679](https://cve.now/CVE-2025-22679.md): WordPress Job Board Manager Plugin \<= 2.1.61 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PickPlugins Job Board Manager)
- [CVE-2025-22677](https://cve.now/CVE-2025-22677.md): WordPress Uix Shortcodes plugin \<= 2.0.3 - Arbitrary Shortcode Execution vulnerability (CVSS 4.8, UIUX Lab Uix Shortcodes)
- [CVE-2025-22292](https://cve.now/CVE-2025-22292.md): WordPress Powerful Auto Chat plugin \<= 1.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Felipe Peixoto Powerful Auto Chat)
- [CVE-2025-22260](https://cve.now/CVE-2025-22260.md): WordPress Meta Tag Manager plugin \<= 3.1 - Broken Access Control vulnerability (CVSS 4.3, Marcus (aka @msykes) Meta Tag Manager)
- [CVE-2024-50500](https://cve.now/CVE-2024-50500.md): WordPress Phlox Core Elements plugin \<= 2.17.4 - Broken Access Control vulnerability (CVSS 4.3, averta Shortcodes and extra features for Phlox theme)
- [CVE-2024-43333](https://cve.now/CVE-2024-43333.md): WordPress Admin and Site Enhancements (ASE) Pro Plugin \<= 7.6.2.1 - Privilege Escalation vulnerability (CVSS 7.5, NotFound Admin and Site Enhancements (ASE) Pro)
- [CVE-2025-24707](https://cve.now/CVE-2025-24707.md): WordPress Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin \<= 2.7.7.24 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, gt3themes Photo Gallery)
- [CVE-2025-24697](https://cve.now/CVE-2025-24697.md): WordPress Image Gallery – Responsive Photo Gallery plugin \<= 1.0.5 - Broken Access Control vulnerability (CVSS 6.5, Realwebcare Image Gallery – Responsive Photo Gallery)
- [CVE-2025-24684](https://cve.now/CVE-2025-24684.md): WordPress Media Downloader Plugin \<= 0.4.7.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ederson Peka Media Downloader)
- [CVE-2025-24676](https://cve.now/CVE-2025-24676.md): WordPress Custom WP Store Locator plugin \<= 1.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, umangmetatagg Custom WP Store Locator)
- [CVE-2025-24660](https://cve.now/CVE-2025-24660.md): WordPress Simple Membership Custom Messages Plugin \<= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wp.insider Simple Membership Custom Messages)
- [CVE-2025-24656](https://cve.now/CVE-2025-24656.md): WordPress Realtyna Provisioning Plugin \<= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Realtyna Provisioning)
- [CVE-2025-24646](https://cve.now/CVE-2025-24646.md): WordPress XML for Avito Plugin \<= 2.5.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, icopydoc XML for Avito)
- [CVE-2025-24643](https://cve.now/CVE-2025-24643.md): WordPress WPGuppy plugin \<= 1.1.0 - Broken Authentication vulnerability (CVSS 6.5, AmentoTech Private Limited WPGuppy)
- [CVE-2025-24642](https://cve.now/CVE-2025-24642.md): WordPress Setup Default Featured Image plugin \<= 1.2 - Broken Access Control vulnerability (CVSS 6.5, theme funda Setup Default Featured Image)
- [CVE-2025-24639](https://cve.now/CVE-2025-24639.md): WordPress Korea for WooCommerce plugin \<= 1.1.11 - Sensitive Data Exposure vulnerability (CVSS 6.5, Greys Korea for WooCommerce)
- [CVE-2025-24631](https://cve.now/CVE-2025-24631.md): WordPress BP Email Assign Templates Plugin \<= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, shanebp BP Email Assign Templates)
- [CVE-2025-24630](https://cve.now/CVE-2025-24630.md): WordPress Sikshya LMS Plugin \<= 0.0.21 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, MantraBrain Sikshya LMS)
- [CVE-2025-24629](https://cve.now/CVE-2025-24629.md): WordPress Import Excel to Gravity Forms Plugin \<= 1.18 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpgear Import Excel to Gravity Forms)
- [CVE-2025-24620](https://cve.now/CVE-2025-24620.md): WordPress AIO Shortcodes plugin \<= 1.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, hkharpreetkumar1 AIO Shortcodes)
- [CVE-2025-24605](https://cve.now/CVE-2025-24605.md): WordPress WOLF plugin \<= 1.0.8.5 - Path Traversal vulnerability (CVSS 7.5, RealMag777 WOLF)
- [CVE-2025-24576](https://cve.now/CVE-2025-24576.md): WordPress Landing Page Cat plugin \<= 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fatcatapps Landing Page Cat)
- [CVE-2025-24574](https://cve.now/CVE-2025-24574.md): WordPress PeproDev WooCommerce Receipt Uploader plugin \<= 2.6.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pepro Dev. Group PeproDev WooCommerce Receipt Uploader)
- [CVE-2025-24569](https://cve.now/CVE-2025-24569.md): WordPress PDF Generator Addon for Elementor Page Builder plugin \<= 1.7.5 - Arbitrary File Read vulnerability (CVSS 7.5, RedefiningTheWeb PDF Generator Addon for Elementor Page Bui…)
- [CVE-2025-24559](https://cve.now/CVE-2025-24559.md): WordPress WP Mailster plugin \<= 1.8.15.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, brandtoss WP Mailster)
- [CVE-2025-24557](https://cve.now/CVE-2025-24557.md): WordPress PlainInventory plugin \<= 3.1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, plainware PlainInventory)
- [CVE-2025-24556](https://cve.now/CVE-2025-24556.md): WordPress MooWoodle plugin \<= 3.2.4 - Sensitive Data Exposure vulnerability (CVSS 7.5, DualCube MooWoodle)
- [CVE-2025-24545](https://cve.now/CVE-2025-24545.md): WordPress BSK Forms Validation plugin \<= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bannersky BSK Forms Validation)
- [CVE-2025-24544](https://cve.now/CVE-2025-24544.md): WordPress Bitcoin and Altcoin Wallets plugin \<= 6.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dashed-slug.net Bitcoin and Altcoin Wallets)
- [CVE-2025-24541](https://cve.now/CVE-2025-24541.md): WordPress DK White Label plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dinamiko DK White Label)
- [CVE-2025-24536](https://cve.now/CVE-2025-24536.md): WordPress ThriveDesk plugin \<= 2.0.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThriveDesk)
- [CVE-2025-23923](https://cve.now/CVE-2025-23923.md): WordPress Lockets Plugin \<= 0.999 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wackey Lockets)
- [CVE-2025-23920](https://cve.now/CVE-2025-23920.md): WordPress ApplicantPro Plugin \<= 1.3.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sourcing Team ApplicantPro)
- [CVE-2025-23819](https://cve.now/CVE-2025-23819.md): WordPress WP Cloud plugin \<= 1.4.3 - Arbitrary File Deletion vulnerability (CVSS 7.5, Marco Milesi WP Cloud)
- [CVE-2025-23799](https://cve.now/CVE-2025-23799.md): WordPress .TUBE Video Curator Plugin \<= 1.1.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tubegtld .TUBE Video Curator)
- [CVE-2025-23755](https://cve.now/CVE-2025-23755.md): WordPress PAFacile plugin \<= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tosend.it PAFacile)
- [CVE-2025-23747](https://cve.now/CVE-2025-23747.md): WordPress Awesome Timeline plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nitesh Awesome Timeline)
- [CVE-2025-23685](https://cve.now/CVE-2025-23685.md): WordPress RomanCart On WordPress plugin \<= 0.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WebTechGlobal RomanCart)
- [CVE-2025-23614](https://cve.now/CVE-2025-23614.md): WordPress WordPress Additional Logins plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, niksudan WordPress Additional Logins)
- [CVE-2025-23599](https://cve.now/CVE-2025-23599.md): WordPress eMarksheet plugin \<= 5.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Aarvansh Infotech eMarksheet)
- [CVE-2025-23594](https://cve.now/CVE-2025-23594.md): WordPress Google Map With Fancybox plugin \<= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Uzzal Mondal Google Map With Fancybox)
- [CVE-2025-23593](https://cve.now/CVE-2025-23593.md): WordPress EmailPress plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kvvaradha EmailPress)
- [CVE-2025-23591](https://cve.now/CVE-2025-23591.md): WordPress blu Logistics plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, blulogistics1 blu Logistics)
- [CVE-2025-23590](https://cve.now/CVE-2025-23590.md): WordPress Dezdy plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dezdy.com Dezdy)
- [CVE-2025-23588](https://cve.now/CVE-2025-23588.md): WordPress WOW Best CSS Compiler plugin \<= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, baonguyenyam WOW Best CSS Compiler)
- [CVE-2025-23582](https://cve.now/CVE-2025-23582.md): WordPress Bulk Categories Assign plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Haider Ali Bulk Categories Assign)
- [CVE-2025-23581](https://cve.now/CVE-2025-23581.md): WordPress Demo User DZS plugin \<= 1.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, digitalzoomstudio Demo User DZS)
- [CVE-2025-23561](https://cve.now/CVE-2025-23561.md): WordPress MLL Audio Player MP3 Ajax plugin \<= 0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, robertkay MLL Audio Player MP3 Ajax)
- [CVE-2025-23527](https://cve.now/CVE-2025-23527.md): WordPress WC Wallet plugin \<= 2.2.0 - Arbitrary Content Deletion vulnerability (CVSS 6.5, hemnathmouli WC Wallet)
- [CVE-2025-23491](https://cve.now/CVE-2025-23491.md): WordPress VSTEMPLATE Creator plugin \<= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Vikash Srivastava VSTEMPLATE Creator)
- [CVE-2025-24781](https://cve.now/CVE-2025-24781.md): WordPress WPJobBoard plugin \<= 5.10.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NotFound WPJobBoard)
- [CVE-2025-0015](https://cve.now/CVE-2025-0015.md): Mali GPU Kernel Driver allows improper GPU processing operations (CVSS 7.8, Arm Valhall GPU Kernel Driver · Arm 5th Gen GPU Architectur…)
- [CVE-2024-6790](https://cve.now/CVE-2024-6790.md): Mali GPU Kernel Driver can cause the whole system to become unresponsive (CVSS 4.0, Arm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1)
- [CVE-2024-10395](https://cve.now/CVE-2024-10395.md): net: lib: http\_server: Buffer Under-read (CVSS 8.6, zephyrproject-rtos Zephyr)
- [CVE-2024-13347](https://cve.now/CVE-2024-13347.md): Essential WP Real Estate \<= 1.1.3 - Reflected XSS (CVSS 6.8, Essential WP Real Estate)
- [CVE-2024-20147](https://cve.now/CVE-2024-20147.md): In Bluetooth FW, there is a possible reachable assertion due to improper exception handling. (CVSS 5.3, MediaTek MT2737, MT3603, MT6835, MT6878, MT6886, MT6897, MT…)
- [CVE-2025-20643](https://cve.now/CVE-2025-20643.md): In DA, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.7, MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2025-20642](https://cve.now/CVE-2025-20642.md): In DA, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.2, MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2025-20641](https://cve.now/CVE-2025-20641.md): In DA, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.3, MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2025-20640](https://cve.now/CVE-2025-20640.md): In DA, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.2, MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2025-20639](https://cve.now/CVE-2025-20639.md): In DA, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.2, MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2025-20638](https://cve.now/CVE-2025-20638.md): In DA, there is a possible read of uninitialized heap data due to uninitialized data. (CVSS 4.6, MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2024-20142](https://cve.now/CVE-2024-20142.md): In V5 DA, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.2, MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2024-20141](https://cve.now/CVE-2024-20141.md): In V5 DA, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.8, MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2025-20637](https://cve.now/CVE-2025-20637.md): In network HW, there is a possible system hang due to an uncaught exception. (CVSS 7.5, MediaTek MT7981, MT7986)
- [CVE-2025-20636](https://cve.now/CVE-2025-20636.md): In secmem, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2025-20635](https://cve.now/CVE-2025-20635.md): In V6 DA, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.6, MediaTek MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT…)
- [CVE-2025-20634](https://cve.now/CVE-2025-20634.md): In Modem, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, MediaTek MT2737, MT6813, MT6835, MT6835T, MT6878, MT6878M,…)
- [CVE-2025-20631](https://cve.now/CVE-2025-20631.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, MediaTek MT7615, MT7622, MT7663, MT7915, MT7916, MT7981, MT…)
- [CVE-2025-20632](https://cve.now/CVE-2025-20632.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, MediaTek MT7615, MT7622, MT7663, MT7915, MT7916, MT7981, MT…)
- [CVE-2025-20633](https://cve.now/CVE-2025-20633.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 8.8, MediaTek MT7603, MT7615, MT7622, MT7915)
- [CVE-2025-0974](https://cve.now/CVE-2025-0974.md): MaxD Lightning Module deserialization (CVSS 2.3, MaxD Lightning Module)
- [CVE-2025-0973](https://cve.now/CVE-2025-0973.md): CmsEasy index.php backAll\_action path traversal (CVSS 5.3, CmsEasy)
- [CVE-2025-0972](https://cve.now/CVE-2025-0972.md): Zenvia Movidesk New Ticket cross site scripting (CVSS 5.3, Zenvia Movidesk)
- [CVE-2023-52163](https://cve.now/CVE-2023-52163.md): Digiever DS-2105 Pro 3.1.0.71-11 devices allow time\_tzsetup.cgi Command Injection. (CVSS 8.8, KEV)
- [CVE-2023-52164](https://cve.now/CVE-2023-52164.md): access\_device.cgi on Digiever DS-2105 Pro 3.1.0.71-11 devices allows arbitrary file read. (CVSS 5.1)
- [CVE-2024-34896](https://cve.now/CVE-2024-34896.md): An issue in Nedis SmartLife Video Doorbell (WIFICDP10GY), Nedis SmartLife IOS v1.4.0 causes users who are disconnected from a previous peer- (CVSS 7.5)
- [CVE-2024-34897](https://cve.now/CVE-2024-34897.md): Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability. (CVSS 7.5)
- [CVE-2024-36437](https://cve.now/CVE-2024-36437.md): The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (wi (CVSS 6.5)
- [CVE-2024-44449](https://cve.now/CVE-2024-44449.md): Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive information via the msg para (CVSS 6.1)
- [CVE-2024-50656](https://cve.now/CVE-2024-50656.md): itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php. (CVSS 6.1)
- [CVE-2024-53942](https://cve.now/CVE-2024-53942.md): An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices. (CVSS 4.8)
- [CVE-2024-53943](https://cve.now/CVE-2024-53943.md): An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices. (CVSS 6.1)
- [CVE-2024-54840](https://cve.now/CVE-2024-54840.md): PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues (CVSS 4.2, CyberArk Privileged Access Manager)
- [CVE-2024-55456](https://cve.now/CVE-2024-55456.md): lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray\_find\_cell (CVSS 6.5, lunasvg)
- [CVE-2024-56898](https://cve.now/CVE-2024-56898.md): Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. (CVSS 8.8)
- [CVE-2024-56901](https://cve.now/CVE-2024-56901.md): A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers t (CVSS 8.8)
- [CVE-2024-56902](https://cve.now/CVE-2024-56902.md): Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account in (CVSS 7.5)
- [CVE-2024-56903](https://cve.now/CVE-2024-56903.md): Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionali (CVSS 8.1)
- [CVE-2024-56921](https://cve.now/CVE-2024-56921.md): An issue was discovered in Open5gs v2.7.2. (CVSS 7.5)
- [CVE-2024-56946](https://cve.now/CVE-2024-56946.md): Denial of service in DNS-over-QUIC in Technitium DNS Server \<= v13.2.2 allows remote attackers to permanently stop the server from accepting (CVSS 5.3)
- [CVE-2024-57004](https://cve.now/CVE-2024-57004.md): Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email (CVSS 6.1)
- [CVE-2024-57097](https://cve.now/CVE-2024-57097.md): ClassCMS 4.8 is vulnerable to Cross Site Scripting (XSS) in class/admin/channel.php. (CVSS 4.8)
- [CVE-2024-57098](https://cve.now/CVE-2024-57098.md): Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter. (CVSS 9.8)
- [CVE-2024-57099](https://cve.now/CVE-2024-57099.md): ClassCMS v4.8 has a code execution vulnerability. (CVSS 9.8)
- [CVE-2024-57175](https://cve.now/CVE-2024-57175.md): A Stored Cross-Site Scripting (XSS) vulnerability was identified in the PHPGURUKUL Online Birth Certificate System v1.0 via the profile name (CVSS 5.4)
- [CVE-2024-57237](https://cve.now/CVE-2024-57237.md): Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to Cross Site Scripting (XSS) in the /reqproc/proc\_get endpoint. (CVSS 6.3)
- [CVE-2024-57238](https://cve.now/CVE-2024-57238.md): Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/proc\_get endpoint. (CVSS 7.3)
- [CVE-2024-57450](https://cve.now/CVE-2024-57450.md): ChestnutCMS \<=1.5.0 is vulnerable to File Upload via the Create template function. (CVSS 9.8)
- [CVE-2024-57451](https://cve.now/CVE-2024-57451.md): ChestnutCMS \<=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to (CVSS 7.5)
- [CVE-2024-57452](https://cve.now/CVE-2024-57452.md): ChestnutCMS \<=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete (CVSS 7.5)
- [CVE-2024-57498](https://cve.now/CVE-2024-57498.md): Cross Site Scripting vulnerability in sayski ForestBlog 20241223 allows a remote attacker to escalate privileges via the article editing fun (CVSS 4.8)
- [CVE-2024-57522](https://cve.now/CVE-2024-57522.md): SourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in Users.php. (CVSS 6.4)
- [CVE-2024-57669](https://cve.now/CVE-2024-57669.md): Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive information via the Bac (CVSS 7.5)
- [CVE-2024-57966](https://cve.now/CVE-2024-57966.md): libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive. (CVSS 5.0, KDE ark)
- [CVE-2024-57967](https://cve.now/CVE-2024-57967.md): PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 has potentially elevated privileges in LDAP m (CVSS 4.2, CyberArk Privileged Access Manager)
- [CVE-2024-57968](https://cve.now/CVE-2024-57968.md): Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible (CVSS 9.9, KEV, Advantive VeraCore)
- [CVE-2025-22918](https://cve.now/CVE-2025-22918.md): Polycom RealPresence Group 500 \<=20 has Insecure Permissions due to automatically loaded cookies. (CVSS 7.5)
- [CVE-2025-22978](https://cve.now/CVE-2025-22978.md): eladmin \<=2.7 is vulnerable to CSV Injection in the exception log download module. (CVSS 9.8)
- [CVE-2025-25062](https://cve.now/CVE-2025-25062.md): An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. (CVSS 4.4, backdropcms backdrop)
- [CVE-2025-25063](https://cve.now/CVE-2025-25063.md): An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. (CVSS 4.4, backdropcms backdrop)
- [CVE-2025-25064](https://cve.now/CVE-2025-25064.md): SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 d (CVSS 8.8)
- [CVE-2025-25065](https://cve.now/CVE-2025-25065.md): SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 all (CVSS 5.3)
- [CVE-2025-25066](https://cve.now/CVE-2025-25066.md): nDPI through 4.12 has a potential stack-based buffer overflow in ndpi\_address\_cache\_restore in lib/ndpi\_cache.c. (CVSS 8.1, ntop nDPI)
- [CVE-2025-25181](https://cve.now/CVE-2025-25181.md): A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL (CVSS 5.8, KEV, Advantive VeraCore)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.