# CVEs published 2025-02-07

117 CVEs were published on February 7, 2025: 8 critical, 52 high. Days are UTC.

- [CVE-2025-25187](https://cve.now/CVE-2025-25187.md): Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin (CVSS 7.8, laurent22 joplin)
- [CVE-2025-1114](https://cve.now/CVE-2025-1114.md): newbee-mall Add Category Page save cross site scripting (CVSS 5.1, newbee-mall)
- [CVE-2025-24028](https://cve.now/CVE-2025-24028.md): Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin (CVSS 7.8, laurent22 joplin)
- [CVE-2024-55630](https://cve.now/CVE-2024-55630.md): DOM Clobbering leads to temporary DOS in the note viewer in Joplin (CVSS 3.3, laurent22 joplin)
- [CVE-2025-1113](https://cve.now/CVE-2025-1113.md): taisan tarzan-cms Add Theme admin#themes upload deserialization (CVSS 5.3, taisan tarzan-cms)
- [CVE-2025-24366](https://cve.now/CVE-2025-24366.md): Insufficient sanitization of user provided rsync command in SFTPGo (CVSS 7.5, drakkan sftpgo · github.com/drakkan/sftpgo/v2 +1)
- [CVE-2025-25183](https://cve.now/CVE-2025-25183.md): vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache (CVSS 2.6, vllm-project vllm · vllm)
- [CVE-2025-24980](https://cve.now/CVE-2025-24980.md): Pimcore Admin Classic Bundle allows user enumeration (CVSS 6.9, pimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…)
- [CVE-2021-41528](https://cve.now/CVE-2021-41528.md): Improper authorization related to Import / Export interfaces on RISC Platform (CVSS 5.3, Flexera RISC Platform)
- [CVE-2021-41527](https://cve.now/CVE-2021-41527.md): 2FA bypass on the RISC Platform (CVSS 2.3, Flexera RISC Platform)
- [CVE-2021-27017](https://cve.now/CVE-2021-27017.md): Deserialization of untrusted data (CVSS 6.6, PuppetPu Puppet Agent)
- [CVE-2025-1106](https://cve.now/CVE-2025-1106.md): CmsEasy database\_admin.php restore\_action path traversal (CVSS 5.3, CmsEasy)
- [CVE-2025-1105](https://cve.now/CVE-2025-1105.md): SiberianCMS HTTP GET Request flat cross site scripting (CVSS 5.3, SiberianCMS)
- [CVE-2022-26389](https://cve.now/CVE-2022-26389.md): Improper Access Control Vulnerability in ELI Electrocardiograph Devices (CVSS 7.7, Baxter/ Hillrom ELI 380 Resting Electrocardiograph · We… +2)
- [CVE-2022-26388](https://cve.now/CVE-2022-26388.md): Use of Hard-Coded Password Vulnerability in ELI Electrocardiograph Devices (CVSS 6.4, Welch Allyn ELI 380 Resting Electrocardiograph · Welch A… +2)
- [CVE-2025-1104](https://cve.now/CVE-2025-1104.md): D-Link DHP-W310AV authentication spoofing (CVSS 6.9, D-Link DHP-W310AV)
- [CVE-2024-7425](https://cve.now/CVE-2024-7425.md): WP All Export Pro \<= 1.9.1 - Authenticated (ShopManager+) Arbtirary Options Update (CVSS 6.8, WP All Import WP All Export Pro)
- [CVE-2024-9661](https://cve.now/CVE-2024-9661.md): WP All Import Pro \<= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion (CVSS 4.3, Soflyy WP All Import Pro)
- [CVE-2024-7419](https://cve.now/CVE-2024-7419.md): WP All Export Pro \<= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export Fields (CVSS 8.3, WP All Import WP All Export Pro)
- [CVE-2024-9664](https://cve.now/CVE-2024-9664.md): WP All Import Pro \<= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File (CVSS 7.2, Soflyy WP All Import Pro)
- [CVE-2025-1103](https://cve.now/CVE-2025-1103.md): D-Link DIR-823X HTTP POST Request set\_wifi\_blacklists null pointer dereference (CVSS 7.1, D-Link DIR-823X)
- [CVE-2024-10383](https://cve.now/CVE-2024-10383.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab VSCode Fork (CVSS 8.7, GitLab VSCode Fork)
- [CVE-2025-1108](https://cve.now/CVE-2025-1108.md): Insufficient data authenticity vulnerability in Janto (CVSS 8.6, Impronta Janto)
- [CVE-2025-1107](https://cve.now/CVE-2025-1107.md): Unverified password change vulnerability in Janto (CVSS 9.9, Impronta Janto)
- [CVE-2025-25069](https://cve.now/CVE-2025-25069.md): Apache Kvrocks: Cross-Protocol Scripting Vulnerability (CVSS 6.5, Apache Software Foundation Apache Kvrocks)
- [CVE-2025-25167](https://cve.now/CVE-2025-25167.md): WordPress BookPress – For Book Authors Plugin \<= 1.2.7 - Broken Access Control vulnerability (CVSS 8.2, Black and White BookPress – For Book Authors)
- [CVE-2025-25168](https://cve.now/CVE-2025-25168.md): WordPress BookPress – For Book Authors Plugin \<= 1.2.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, Black and White BookPress – For Book Authors)
- [CVE-2025-25166](https://cve.now/CVE-2025-25166.md): WordPress InLocation plugin \<= 1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, gabrieldarezzo InLocation)
- [CVE-2025-25163](https://cve.now/CVE-2025-25163.md): WordPress Plugin A/B Image Optimizer Plugin \<= 3.3 - Arbitrary File Download vulnerability (CVSS 7.5, Zach Swetz Plugin A/B Image Optimizer)
- [CVE-2025-25155](https://cve.now/CVE-2025-25155.md): WordPress Music Sheet Viewer plugin \<= 4.1 - Arbitrary File Read vulnerability (CVSS 7.5, efreja Music Sheet Viewer)
- [CVE-2025-25154](https://cve.now/CVE-2025-25154.md): WordPress Custom Comment Notifications plugin \<= 1.0.8 - CSRF to Stored XSS vulnerability (CVSS 7.1, scweber Custom Comment Notifications)
- [CVE-2025-25159](https://cve.now/CVE-2025-25159.md): WordPress WP doodlez plugin \<= 1.0.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, robert\_kolatzek WP doodlez)
- [CVE-2025-25160](https://cve.now/CVE-2025-25160.md): WordPress Style Tweaker plugin \<= 0.11 - CSRF to Stored XSS vulnerability (CVSS 7.1, Mark Barnes Style Tweaker)
- [CVE-2025-25152](https://cve.now/CVE-2025-25152.md): WordPress Smart DoFollow plugin \<= 1.0.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, LukaszWiecek Smart DoFollow)
- [CVE-2025-25156](https://cve.now/CVE-2025-25156.md): WordPress Quote Comments plugin \<= 3.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Stanko Metodiev Quote Comments)
- [CVE-2025-25153](https://cve.now/CVE-2025-25153.md): WordPress Simple Auto Tag plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, djjmz Simple Auto Tag)
- [CVE-2025-25151](https://cve.now/CVE-2025-25151.md): WordPress uListing Plugin \<= 2.1.6 - SQL Injection vulnerability (CVSS 8.5, Stylemix uListing)
- [CVE-2025-25144](https://cve.now/CVE-2025-25144.md): WordPress Theasys plugin \<= 1.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Theasys)
- [CVE-2025-25149](https://cve.now/CVE-2025-25149.md): WordPress Login-box plugin \<= 2.0.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, Danillo Nunes Login-box)
- [CVE-2025-25141](https://cve.now/CVE-2025-25141.md): WordPress Fami Sales Popup plugin \<= 2.0.0 - Local File Inclusion vulnerability (CVSS 7.5, zankover Fami Sales Popup)
- [CVE-2025-25143](https://cve.now/CVE-2025-25143.md): WordPress GlobalQuran Plugin \<= 1.0 - CSRF to Settings Change vulnerability (CVSS 4.3, ibasit GlobalQuran)
- [CVE-2025-25147](https://cve.now/CVE-2025-25147.md): WordPress Auto SEO plugin \<= 2.5.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, Phillip.Gooch Auto SEO)
- [CVE-2025-25138](https://cve.now/CVE-2025-25138.md): WordPress On Page SEO + Social Live Chat (Formerly OPS) plugin \<= 2.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Rishi On Page SEO + Whatsapp Chat Button)
- [CVE-2025-25135](https://cve.now/CVE-2025-25135.md): WordPress Custom Links On Admin Dashboard Toolbar plugin \<= 3.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Victor Barkalov Custom Links On Admin Dashboard Toolbar)
- [CVE-2025-25148](https://cve.now/CVE-2025-25148.md): WordPress Read More Copy Link plugin \<= 1.0.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, ElbowRobo Read More Copy Link)
- [CVE-2025-25140](https://cve.now/CVE-2025-25140.md): WordPress Simple User Profile plugin \<= 1.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, Scriptonite Simple User Profile)
- [CVE-2025-25139](https://cve.now/CVE-2025-25139.md): WordPress WP Custom Post RSS Feed plugin \<= 1.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Cynob IT Consultancy WP Custom Post RSS Feed)
- [CVE-2025-25145](https://cve.now/CVE-2025-25145.md): WordPress Infusionsoft Analytics Plugin \<= 2.0 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, jordan.hatch Infusionsoft Analytics)
- [CVE-2025-25136](https://cve.now/CVE-2025-25136.md): WordPress Optimate Ads plugin \<= 1.0.3 - Cross-Site Scripting (XSS) vulnerability (CVSS 6.5, shujahat21 Optimate Ads)
- [CVE-2025-25126](https://cve.now/CVE-2025-25126.md): WordPress ZMSEO plugin \<= 1.14.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, ZMSEO)
- [CVE-2025-25146](https://cve.now/CVE-2025-25146.md): WordPress Songkick Concerts and Festivals plugin \<= 0.9.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, saleandro Songkick Concerts and Festivals)
- [CVE-2025-25128](https://cve.now/CVE-2025-25128.md): WordPress Facilita Form Tracker plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, orlandolac Facilita Form Tracker)
- [CVE-2025-25123](https://cve.now/CVE-2025-25123.md): WordPress Easy Related Posts plugin \<= 2.0.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, xdark Easy Related Posts)
- [CVE-2025-25125](https://cve.now/CVE-2025-25125.md): WordPress Fyrebox Quizzes plugin \<= 3.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, CyrilG Fyrebox Quizzes)
- [CVE-2025-25116](https://cve.now/CVE-2025-25116.md): WordPress Link to URL / Post plugin \<=1.3 - SQL Injection vulnerability (CVSS 7.6, sudipto Link to URL / Post)
- [CVE-2025-25117](https://cve.now/CVE-2025-25117.md): WordPress Smart Countdown FX plugin \<= 1.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Alex Polonski Smart Countdown FX)
- [CVE-2025-25120](https://cve.now/CVE-2025-25120.md): WordPress Slide Banners plugin \<= 1.3 - Broken Access Control vulnerability (CVSS 4.3, Melodic Media Slide Banners)
- [CVE-2025-25103](https://cve.now/CVE-2025-25103.md): WordPress Indeed API Plugin \<= 0.5 - CSRF to Settings Change vulnerability (CVSS 4.3, bnielsen Indeed API)
- [CVE-2025-25105](https://cve.now/CVE-2025-25105.md): WordPress Pop Up Plugin \<= 0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, coffeestudios Pop Up)
- [CVE-2025-25101](https://cve.now/CVE-2025-25101.md): WordPress Munk Sites plugin \<= 1.0.7 - CSRF to Arbitrary Plugin Installation vulnerability (CVSS 9.6, MetricThemes Munk Sites)
- [CVE-2025-25107](https://cve.now/CVE-2025-25107.md): WordPress OneStore Sites plugin \<= 0.1.1 - CSRF to Arbitrary Plugin Installation vulnerability (CVSS 9.6, sainwp OneStore Sites)
- [CVE-2025-25106](https://cve.now/CVE-2025-25106.md): WordPress Starter Templates by FancyWP plugin \<= 2.0.0 - CSRF to Arbitrary Plugin Installation vulnerability (CVSS 9.6, Starter Templates by FancyWP)
- [CVE-2025-25097](https://cve.now/CVE-2025-25097.md): WordPress External "Video for Everybody" plugin \<= 2.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, kwiliarty External Video For Everybody)
- [CVE-2025-25088](https://cve.now/CVE-2025-25088.md): WordPress WP Keyword Monitor Plugin \<=1.0.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, blackus3r WP Keyword Monitor)
- [CVE-2025-25110](https://cve.now/CVE-2025-25110.md): WordPress Event Kikfyre plugin \<= 2.1.8 - Broken Access Control vulnerability (CVSS 5.4, Metagauss Event Kikfyre)
- [CVE-2025-25111](https://cve.now/CVE-2025-25111.md): WordPress WP Spell Check plugin \<= 9.21 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, WP Spell Check)
- [CVE-2025-25081](https://cve.now/CVE-2025-25081.md): WordPress Embed RSS plugin \<= 3.1 - Arbitrary Shortcode Execution vulnerability (CVSS 4.8, DeannaS Embed RSS)
- [CVE-2025-25104](https://cve.now/CVE-2025-25104.md): WordPress URL-Preview-Box plugin \<= 1.20 - CSRF to Stored XSS vulnerability (CVSS 7.1, mraliende URL-Preview-Box)
- [CVE-2025-25093](https://cve.now/CVE-2025-25093.md): WordPress Child Themes Helper plugin \<= 2.2.7 - CSRF to Arbitrary File Deletion vulnerability (CVSS 6.1, paulswarthout Child Themes Helper)
- [CVE-2025-25095](https://cve.now/CVE-2025-25095.md): WordPress ReverbNation Widgets plugin \<= 2.1 - Cross Site Scripting (XSS) vulnerability\< (CVSS 6.5, reverbnationdev ReverbNation Widgets)
- [CVE-2025-25096](https://cve.now/CVE-2025-25096.md): WordPress RSS in Page plugin \<= 2.9.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, titusbicknell RSS in Page)
- [CVE-2025-25085](https://cve.now/CVE-2025-25085.md): WordPress WP SimpleWeather plugin \<= 0.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, matt\_mcbrien WP SimpleWeather)
- [CVE-2025-25071](https://cve.now/CVE-2025-25071.md): WordPress Vignette Ads plugin \<= 0.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, topplugins Vignette Ads)
- [CVE-2025-25094](https://cve.now/CVE-2025-25094.md): WordPress Breaking News Ticker plugin \<= 2.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Amitythemes.com Breaking News Ticker)
- [CVE-2025-25080](https://cve.now/CVE-2025-25080.md): WordPress Kona Gallery Block plugin \<= 1.7 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, gubbigubbi Kona Gallery Block)
- [CVE-2025-25077](https://cve.now/CVE-2025-25077.md): WordPress Easy Chart Builder for WordPress plugin \<= 1.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, dugbug Easy Chart Builder for WordPress)
- [CVE-2025-25075](https://cve.now/CVE-2025-25075.md): WordPress Show notice or message on admin area plugin \<= 2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Venugopal Show notice or message on admin area)
- [CVE-2025-25078](https://cve.now/CVE-2025-25078.md): WordPress Google Earth Embed plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Andrew Norcross Google Earth Embed)
- [CVE-2025-25074](https://cve.now/CVE-2025-25074.md): WordPress WP Social Stream plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Nirmal Kumar Ram WP Social Stream)
- [CVE-2025-25079](https://cve.now/CVE-2025-25079.md): WordPress Simple Select All Text Box plugin \<= 3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Garrett Grimm Simple Select All Text Box)
- [CVE-2025-25098](https://cve.now/CVE-2025-25098.md): WordPress Links in Captions plugin \<= 1.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Zack Katz Links in Captions)
- [CVE-2025-25073](https://cve.now/CVE-2025-25073.md): WordPress Easy WP Tiles plugin \<= 1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Vasilis Triantafyllou Easy WP Tiles)
- [CVE-2025-25082](https://cve.now/CVE-2025-25082.md): WordPress flexIDX Home Search plugin \<= 2.1.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Max Chirkov FlexIDX Home Search)
- [CVE-2025-25072](https://cve.now/CVE-2025-25072.md): WordPress WP Admin Custom Page plugin \<= 1.5.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, thunderbax WP Admin Custom Page)
- [CVE-2025-25091](https://cve.now/CVE-2025-25091.md): WordPress NextGen Cooliris Gallery plugin \<= 0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, zackdesign NextGen Cooliris Gallery)
- [CVE-2025-25076](https://cve.now/CVE-2025-25076.md): WordPress Graceful Email Obfuscation plugin \<= 0.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nicholaswilson Graceful Email Obfuscation)
- [CVE-2025-0304](https://cve.now/CVE-2025-0304.md): Liteos\_a has an use after free vulnerability (CVSS 8.8, OpenHarmony)
- [CVE-2025-0303](https://cve.now/CVE-2025-0303.md): Liteos\_a has a buffer overflow vulnerability (CVSS 8.8, OpenHarmony)
- [CVE-2025-0302](https://cve.now/CVE-2025-0302.md): Liteos\_a has an integer overflow read vulnerability (CVSS 5.5, OpenHarmony)
- [CVE-2025-1077](https://cve.now/CVE-2025-1077.md): Remote Code Execution vulnerability in IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather) (CVSS 9.5, IBL Software Engineering Visual Weather · IBL Software E… +2)
- [CVE-2025-22880](https://cve.now/CVE-2025-22880.md): Heap-based Buffer Overflow in CNCSoft-G2 (CVSS 7.8, Delta Electronics CNCSoft-G2)
- [CVE-2025-23085](https://cve.now/CVE-2025-23085.md): A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. (CVSS 5.3, NodeJS Node)
- [CVE-2024-13841](https://cve.now/CVE-2024-13841.md): Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time \<= 1.0.0 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, daveshine Builder Shortcode Extras – WordPress Shortcodes C…)
- [CVE-2024-13492](https://cve.now/CVE-2024-13492.md): Guten Free Options \<= 0.9.5 - Reflected XSS (CVSS 6.1, Guten Free Options)
- [CVE-2024-13352](https://cve.now/CVE-2024-13352.md): Legull \<= 1.2.2 - Reflected XSS (CVSS 7.1, Legull)
- [CVE-2025-1072](https://cve.now/CVE-2025-1072.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-22402](https://cve.now/CVE-2025-22402.md): Dell Update Manager Plugin, version(s) 1.5.0 through 1.6.0, contain(s) an Improper Neutralization of Script-Related HTML Tags in a Web Page (CVSS 2.6, Dell Update Manager Plugin)
- [CVE-2025-1061](https://cve.now/CVE-2025-1061.md): Nextend Social Login Pro \<= 3.1.16 - Authentication Bypass via Apple OAuth provider (CVSS 9.8, nextendweb Nextend Social Login Pro)
- [CVE-2025-1086](https://cve.now/CVE-2025-1086.md): Safetytest Cloud-Master Server static path traversal (CVSS 6.9, Safetytest Cloud-Master Server)
- [CVE-2025-1085](https://cve.now/CVE-2025-1085.md): Animati PACS login cross site scripting (CVSS 5.3, Animati PACS)
- [CVE-2024-35106](https://cve.now/CVE-2024-35106.md): NEXTU FLETA AX1500 WIFI6 v1.0.3 was discovered to contain a buffer overflow at /boafrm/formIpQoS. (CVSS 4.6)
- [CVE-2024-48091](https://cve.now/CVE-2024-48091.md): Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. (CVSS 7.8)
- [CVE-2024-52881](https://cve.now/CVE-2024-52881.md): An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. (CVSS 7.5)
- [CVE-2024-52882](https://cve.now/CVE-2024-52882.md): An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. (CVSS 6.1)
- [CVE-2024-52883](https://cve.now/CVE-2024-52883.md): An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. (CVSS 7.5)
- [CVE-2024-52884](https://cve.now/CVE-2024-52884.md): An issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841. (CVSS 7.5)
- [CVE-2024-55213](https://cve.now/CVE-2024-55213.md): Directory Traversal vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the File Listin (CVSS 6.5)
- [CVE-2024-55214](https://cve.now/CVE-2024-55214.md): Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file downl (CVSS 6.5)
- [CVE-2024-55215](https://cve.now/CVE-2024-55215.md): An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register. (CVSS 9.8)
- [CVE-2024-55272](https://cve.now/CVE-2024-55272.md): An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function. (CVSS 7.5)
- [CVE-2024-57248](https://cve.now/CVE-2024-57248.md): Directory Traversal in File Upload in Gleamtech FileVista 9.2.0.0 allows remote attackers to achieve Code Execution, Information Disclosure, (CVSS 6.3)
- [CVE-2024-57249](https://cve.now/CVE-2024-57249.md): Incorrect Access Control in the Preview Function of Gleamtech FileVista 9.2.0.0 allows remote attackers to gain unauthorized access via expl (CVSS 6.5)
- [CVE-2024-57278](https://cve.now/CVE-2024-57278.md): A reflected Cross-Site Scripting (XSS) vulnerability exists in /webscan/sqlmap/index.html in QingScan \<=v1.8.0. (CVSS 5.4)
- [CVE-2024-57279](https://cve.now/CVE-2024-57279.md): A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the LDAP User Manager \<= ce92321, specifically in the /setup/ind (CVSS 5.4)
- [CVE-2024-57357](https://cve.now/CVE-2024-57357.md): An issue in TPLINK TL-WPA 8630 TL-WPA8630(US)\_V2\_2.0.4 Build 20230427 allows a remote attacker to execute arbitrary code via function sub\_42 (CVSS 8.0)
- [CVE-2024-57606](https://cve.now/CVE-2024-57606.md): SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker to obtain sensitive (CVSS 7.5, org.jeecgframework.boot:jeecg-boot-common)
- [CVE-2024-57707](https://cve.now/CVE-2024-57707.md): An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.