# CVEs published 2025-02-06

98 CVEs were published on February 6, 2025: 15 critical, 31 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-0675](https://cve.now/CVE-2025-0675.md): Elber Communications Equipment Hidden Functionality (CVSS 7.5, Elber Signum DVB-S/S2 IRD · Elber Cleber/3 Broadcast Mul… +3)
- [CVE-2025-0674](https://cve.now/CVE-2025-0674.md): Elber Communications Equipment Authentication Bypass Using an Alternate Path or Channel (CVSS 9.8, Elber Signum DVB-S/S2 IRD · Elber Cleber/3 Broadcast Mul… +3)
- [CVE-2025-1084](https://cve.now/CVE-2025-1084.md): Mindskip xzs-mysql 学之思开源考试系统 cross-site request forgery (CVSS 5.3, Mindskip xzs-mysql 学之思开源考试系统)
- [CVE-2025-1083](https://cve.now/CVE-2025-1083.md): Mindskip xzs-mysql 学之思开源考试系统 CORS cross-domain policy (CVSS 2.3, Mindskip xzs-mysql 学之思开源考试系统)
- [CVE-2025-21342](https://cve.now/CVE-2025-21342.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Edge)
- [CVE-2025-21408](https://cve.now/CVE-2025-21408.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Edge)
- [CVE-2025-21283](https://cve.now/CVE-2025-21283.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2025-21253](https://cve.now/CVE-2025-21253.md): Microsoft Edge for IOS and Android Spoofing Vulnerability (CVSS 5.3, Microsoft Edge for Android · Microsoft Edge for iOS)
- [CVE-2025-21177](https://cve.now/CVE-2025-21177.md): Microsoft Dynamics 365 Sales Elevation of Privilege Vulnerability (CVSS 8.7, Microsoft Dynamics 365 Sales)
- [CVE-2025-21279](https://cve.now/CVE-2025-21279.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2025-21267](https://cve.now/CVE-2025-21267.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.4, Microsoft Edge)
- [CVE-2025-21404](https://cve.now/CVE-2025-21404.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.3, Microsoft Edge)
- [CVE-2025-1082](https://cve.now/CVE-2025-1082.md): Mindskip xzs-mysql 学之思开源考试系统 Exam Edit edit cross site scripting (CVSS 5.1, Mindskip xzs-mysql 学之思开源考试系统)
- [CVE-2025-1004](https://cve.now/CVE-2025-1004.md): Certain HP LaserJet Pro Printers – Potential Denial of Service (CVSS 6.9, Certain HP LaserJet Pro Printers)
- [CVE-2025-0158](https://cve.now/CVE-2025-0158.md): IBM EntireX denial of service (CVSS 5.5, IBM EntireX)
- [CVE-2025-1081](https://cve.now/CVE-2025-1081.md): Bharti Airtel Xstream Fiber WiFi Password weak credentials (CVSS 2.3, Bharti Airtel Xstream Fiber)
- [CVE-2024-56467](https://cve.now/CVE-2024-56467.md): IBM EntireX information disclosure (CVSS 3.3, IBM EntireX)
- [CVE-2024-54171](https://cve.now/CVE-2024-54171.md): IBM EntireX XML external entity injection (CVSS 7.1, IBM EntireX)
- [CVE-2024-52892](https://cve.now/CVE-2024-52892.md): IBM Jazz for Service Management Cross-Site Scripting (CVSS 6.1, IBM Jazz for Service Management)
- [CVE-2024-47258](https://cve.now/CVE-2024-47258.md): 2N Access Commander version 2.1 and prior is vulnerable in default settings to Man In The Middle attack due to not verifying certificates of (CVSS 8.1, 2N Access Commander)
- [CVE-2024-47256](https://cve.now/CVE-2024-47256.md): Successful exploitation of this vulnerability could allow an attacker (who needs to have Admin access privileges) to read hardcoded AES pass (CVSS 6.0, 2N Access Commander)
- [CVE-2024-13417](https://cve.now/CVE-2024-13417.md): Specifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. (CVSS 4.6, 2N OS)
- [CVE-2024-13416](https://cve.now/CVE-2024-13416.md): Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log. (CVSS 4.3, 2N OS)
- [CVE-2025-24786](https://cve.now/CVE-2025-24786.md): Path traversal opening Sqlite3 database in WhoDB (CVSS 10.0, clidey whodb · github.com/clidey/whodb/core)
- [CVE-2025-24787](https://cve.now/CVE-2025-24787.md): Parameter injection in DB connection URIs leading to local file inclusion in WhoDB (CVSS 8.6, clidey whodb · github.com/clidey/whodb/core)
- [CVE-2025-23217](https://cve.now/CVE-2025-23217.md): Mitmweb API Authentication Bypass Using Proxy Server (CVSS 8.2, mitmproxy)
- [CVE-2025-24981](https://cve.now/CVE-2025-24981.md): Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc (CVSS 9.3, nuxt-modules mdc · @nuxtjs/mdc)
- [CVE-2025-22867](https://cve.now/CVE-2025-22867.md): Arbitrary code execution during build on darwin in cmd/go (CVSS 7.5, Go toolchain cmd/go · toolchain)
- [CVE-2025-1078](https://cve.now/CVE-2025-1078.md): AppHouseKitchen AlDente Charge Limiter XPC Service com.apphousekitchen.aldente-pro.helper shouldAcceptNewConnection improper authorization (CVSS 4.8, AppHouseKitchen AlDente Charge Limiter)
- [CVE-2025-22866](https://cve.now/CVE-2025-22866.md): Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVSS 4.0, Go standard library crypto/internal/nistec · stdlib)
- [CVE-2024-39272](https://cve.now/CVE-2024-39272.md): A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22.5-1533. (CVSS 9.0, ClearML)
- [CVE-2024-43779](https://cve.now/CVE-2024-43779.md): An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. (CVSS 7.7, ClearML)
- [CVE-2024-13614](https://cve.now/CVE-2024-13614.md): Kaspersky has fixed a security issue in Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Light Agent, Kaspersky E (CVSS 5.3, Kaspersky Anti-Virus SDK for Windows · Kaspersky Securit… +9)
- [CVE-2025-0994](https://cve.now/CVE-2025-0994.md): Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization v (CVSS 8.6, KEV, Trimble Cityworks)
- [CVE-2022-31764](https://cve.now/CVE-2022-31764.md): Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBC (CVSS 8.5, Apache Software Foundation Apache ShardingSphere ElasticJob…)
- [CVE-2023-5878](https://cve.now/CVE-2023-5878.md): OneWireless command injection possible when updating firmware (CVSS 9.4, Honeywell OneWireless Network Wireless Device Manager)
- [CVE-2025-1074](https://cve.now/CVE-2025-1074.md): Webkul QloApps URL mylogout cross-site request forgery (CVSS 5.3, Webkul QloApps)
- [CVE-2024-24911](https://cve.now/CVE-2024-24911.md): Out of Bounds read in the CPCA process on Check Point Management Server (CVSS 5.3, checkpoint Multi-Domain Security Management, Quantum Securi…)
- [CVE-2025-1076](https://cve.now/CVE-2025-1076.md): Stored Cross-Site Scripting vulnerability in Holded (CVSS 4.8, Holded)
- [CVE-2024-57962](https://cve.now/CVE-2024-57962.md): Vulnerability of incomplete verification information in the VPN service module Impact: Successful exploitation of this vulnerability may aff (CVSS 6.1, Huawei HarmonyOS)
- [CVE-2024-57961](https://cve.now/CVE-2024-57961.md): Out-of-bounds write vulnerability in the emcom module Impact: Successful exploitation of this vulnerability may cause features to perform ab (CVSS 6.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-57960](https://cve.now/CVE-2024-57960.md): Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerability may affect serv (CVSS 7.7, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-57959](https://cve.now/CVE-2024-57959.md): Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may cause features to perform (CVSS 6.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-57958](https://cve.now/CVE-2024-57958.md): Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may cause features to perfor (CVSS 5.7, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-12602](https://cve.now/CVE-2024-12602.md): Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability may affect service conf (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-57957](https://cve.now/CVE-2024-57957.md): Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affec (CVSS 6.6, Huawei HarmonyOS)
- [CVE-2024-57956](https://cve.now/CVE-2024-57956.md): Out-of-bounds read vulnerability in the interpreter string module Impact: Successful exploitation of this vulnerability may affect availabil (CVSS 2.8, Huawei HarmonyOS)
- [CVE-2024-57955](https://cve.now/CVE-2024-57955.md): Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentialit (CVSS 6.1, Huawei HarmonyOS)
- [CVE-2024-57954](https://cve.now/CVE-2024-57954.md): Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service c (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2025-0982](https://cve.now/CVE-2025-0982.md): Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine) (CVSS 9.4, Google Cloud Application Integration)
- [CVE-2024-37358](https://cve.now/CVE-2024-37358.md): Apache James: denial of service through the use of IMAP literals (CVSS 8.6, Apache Software Foundation Apache James server · org.apache…)
- [CVE-2024-45626](https://cve.now/CVE-2024-45626.md): Apache James: denial of service through JMAP HTML to text conversion (CVSS 6.5, Apache Software Foundation Apache James server · org.apache…)
- [CVE-2025-0859](https://cve.now/CVE-2025-0859.md): Post and Page Builder by BoldGrid \<= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template\_via\_url Function (CVSS 6.5, Post and Page Builder by BoldGrid – Visual Drag and Drop Ed…)
- [CVE-2025-24845](https://cve.now/CVE-2025-24845.md): Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51. (CVSS 6.3, Humming Heads Defense Platform Home Edition)
- [CVE-2025-24483](https://cve.now/CVE-2025-24483.md): NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. (CVSS 6.5, Humming Heads Defense Platform Home Edition)
- [CVE-2025-23236](https://cve.now/CVE-2025-23236.md): Buffer overflow vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. (CVSS 8.8, Humming Heads Defense Platform Home Edition)
- [CVE-2025-20094](https://cve.now/CVE-2025-20094.md): Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. (CVSS 8.8, Humming Heads Defense Platform Home Edition)
- [CVE-2025-22894](https://cve.now/CVE-2025-22894.md): Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. (CVSS 6.5, Humming Heads Defense Platform Home Edition)
- [CVE-2025-22890](https://cve.now/CVE-2025-22890.md): Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. (CVSS 6.5, Humming Heads Defense Platform Home Edition)
- [CVE-2024-13487](https://cve.now/CVE-2024-13487.md): CURCY – Multi Currency for WooCommerce \<= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get\_products\_price Function (CVSS 7.3, villatheme CURCY – Multi Currency for WooCommerce – Smoothl…)
- [CVE-2025-0522](https://cve.now/CVE-2025-0522.md): LikeBot – Decentralized like-system \<= 0.85 - Admin+ Stored XSS via CSRF (CVSS 4.7, LikeBot)
- [CVE-2024-51547](https://cve.now/CVE-2024-51547.md): Credentials Disclosure - keys (CVSS 9.3, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2025-0799](https://cve.now/CVE-2025-0799.md): IBM App Connect Enterprise Arbitrary File Write (CVSS 6.5, IBM App Connect Enterprise)
- [CVE-2024-51450](https://cve.now/CVE-2024-51450.md): IBM Security Verify Directory Command Execution (CVSS 9.1, IBM Security Verify Directory)
- [CVE-2024-49814](https://cve.now/CVE-2024-49814.md): IBM Security Verify Access Appliance Privilege Escalation (CVSS 7.8, IBM Security Verify Access Appliance)
- [CVE-2020-36085](https://cve.now/CVE-2020-36085.md): Stored Cross Site Scripting(XSS) vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 allows remote attackers (CVSS 6.3)
- [CVE-2022-40490](https://cve.now/CVE-2022-40490.md): Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability. (CVSS 4.8)
- [CVE-2022-40916](https://cve.now/CVE-2022-40916.md): Tiny File Manager v2.4.7 and below is vulnerable to session fixation. (CVSS 9.8)
- [CVE-2024-25883](https://cve.now/CVE-2024-25883.md): The mstatus register in RSD commit 3d13a updates incorrectly, leading to processing errors. (CVSS 5.3)
- [CVE-2024-36553](https://cve.now/CVE-2024-36553.md): Forever KidsWatch Call Me KW-50 R36\_YDR\_A3PW\_GM7S\_V1.0\_2019\_07\_15\_16.19.24\_cob\_h is vulnerable to MITM attack. (CVSS 8.1)
- [CVE-2024-36554](https://cve.now/CVE-2024-36554.md): Forever KidsWatch Call Me KW-50 R36\_YDR\_A3PW\_GM7S\_V1.0\_2019\_07\_15\_16.19.24\_cob\_h and Forever KidsWatch Call Me KW-60 R36CW\_YDE\_S4\_A29\_2\_V1.0 (CVSS 9.8)
- [CVE-2024-36555](https://cve.now/CVE-2024-36555.md): Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36\_YDR\_A3PW\_GM7S\_V1.0\_2019\_07\_15\_16.19.24\_cob\_h and Forever KidsWatch (CVSS 9.8)
- [CVE-2024-36556](https://cve.now/CVE-2024-36556.md): Forever KidsWatch Call Me KW50 R36\_YDR\_A3PW\_GM7S\_V1.0\_2019\_07\_15\_16.19.24\_cob\_h, and Forever KidsWatch Call Me 2 KW60 R36CW\_YDE\_S4\_A29\_2\_V1. (CVSS 9.1)
- [CVE-2024-36557](https://cve.now/CVE-2024-36557.md): The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36\_YDR\_A3PW\_GM7S\_V1.0\_2019\_07\_15\_16.19.24\_cob\_h and Forever KidsWatch Call (CVSS 6.6)
- [CVE-2024-36558](https://cve.now/CVE-2024-36558.md): Forever KidsWatch Call Me KW-50 R36\_YDR\_A3PW\_GM7S\_V1.0\_2019\_07\_15\_16.19.24\_cob\_h suffers from Cleartext Transmission of Sensitive Informatio (CVSS 7.5)
- [CVE-2024-39033](https://cve.now/CVE-2024-39033.md): In Newgensoft OmniDocs 11.0\_SP1\_03\_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows user's configuration (CVSS 7.5)
- [CVE-2024-48589](https://cve.now/CVE-2024-48589.md): Cross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code via the rol parameter (CVSS 6.3)
- [CVE-2024-53586](https://cve.now/CVE-2024-53586.md): An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a crafted HTTP request. (CVSS 5.3)
- [CVE-2024-54909](https://cve.now/CVE-2024-54909.md): A vulnerability has been identified in GoldPanKit eva-server v4.1.0. (CVSS 8.1)
- [CVE-2024-55241](https://cve.now/CVE-2024-55241.md): An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py compone (CVSS 8.8)
- [CVE-2024-56889](https://cve.now/CVE-2024-56889.md): Incorrect access control in the endpoint /admin/m\_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to (CVSS 7.5)
- [CVE-2024-57392](https://cve.now/CVE-2024-57392.md): Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Servic (CVSS 7.5)
- [CVE-2024-57426](https://cve.now/CVE-2024-57426.md): NetMod VPN Client 5.3.1 is vulnerable to DLL injection, allowing an attacker to execute arbitrary code by placing a malicious DLL in a direc (CVSS 7.3)
- [CVE-2024-57427](https://cve.now/CVE-2024-57427.md): PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS). (CVSS 6.1)
- [CVE-2024-57428](https://cve.now/CVE-2024-57428.md): A stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fi (CVSS 9.3)
- [CVE-2024-57429](https://cve.now/CVE-2024-57429.md): A cross-site request forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote atta (CVSS 5.4)
- [CVE-2024-57430](https://cve.now/CVE-2024-57430.md): An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate datab (CVSS 9.8)
- [CVE-2024-57523](https://cve.now/CVE-2024-57523.md): Cross Site Request Forgery (CSRF) in Users.php in SourceCodester Packers and Movers Management System 1.0 allows attackers to create unautho (CVSS 4.5)
- [CVE-2024-57599](https://cve.now/CVE-2024-57599.md): Cross Site Scripting vulnerability in DouPHP v.1.8 Release 20231203 allows attackers to execute arbitrary code via a crafted payload injecte (CVSS 4.8)
- [CVE-2024-57609](https://cve.now/CVE-2024-57609.md): An issue in Kanaries Inc Pygwalker before v.0.4.9.9 allows a remote attacker to obtain sensitive information and execute arbitrary code via (CVSS 8.6)
- [CVE-2024-57610](https://cve.now/CVE-2024-57610.md): A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly (CVSS 7.5)
- [CVE-2024-57668](https://cve.now/CVE-2024-57668.md): In Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload vulnerability. (CVSS 8.8)
- [CVE-2024-57672](https://cve.now/CVE-2024-57672.md): An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module, Topologylnstance module, R (CVSS 5.5)
- [CVE-2024-57673](https://cve.now/CVE-2024-57673.md): An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module and Linkdiscovery module (CVSS 5.5)
- [CVE-2025-22936](https://cve.now/CVE-2025-22936.md): An issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W-A1 allows a remote attacker to obtain sensi (CVSS 5.7)
- [CVE-2025-22992](https://cve.now/CVE-2025-22992.md): A SQL Injection vulnerability exists in the /feed/insert.json endpoint of the Emoncms project \>= 11.6.9. (CVSS 9.8)
- [CVE-2025-23093](https://cve.now/CVE-2025-23093.md): The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager through V10 R1.54.1 and V11 through R0.22.1 could allow an authent (CVSS 8.8)
- [CVE-2025-23094](https://cve.now/CVE-2025-23094.md): The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, (CVSS 7.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.