# CVEs published 2025-02-10

73 CVEs were published on February 10, 2025: 3 critical, 24 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2025-1163](https://cve.now/CVE-2025-1163.md): code-projects Vehicle Parking Management System Authentication login stack-based overflow (CVSS 4.8, code-projects Vehicle Parking Management System)
- [CVE-2025-1162](https://cve.now/CVE-2025-1162.md): code-projects Job Recruitment load\\\_user-profile.php sql injection (CVSS 5.3, code-projects Job Recruitment)
- [CVE-2025-1160](https://cve.now/CVE-2025-1160.md): SourceCodester Employee Management System index.php default credentials (CVSS 6.9, SourceCodester Employee Management System)
- [CVE-2025-25194](https://cve.now/CVE-2025-25194.md): Server-Side Request Forgery (SSRF) in activitypub\_federation (CVSS 4.0, LemmyNet lemmy · activitypub\_federation)
- [CVE-2025-25190](https://cve.now/CVE-2025-25190.md): \[XBOW-025-033\] Cross-Site Scripting (XSS) via EchoProcess Service in ZOO-Project WPS Server (CVSS 5.5, ZOO-Project)
- [CVE-2025-25189](https://cve.now/CVE-2025-25189.md): \[XBOW-025-031\] Reflected Cross-Site Scripting via jobid Parameter in ZOO-Project WPS publish.py CGI Script (CVSS 5.5, ZOO-Project)
- [CVE-2025-25193](https://cve.now/CVE-2025-25193.md): Denial of Service attack on windows app using Netty (CVSS 5.5, netty · io.netty:netty-common)
- [CVE-2025-1159](https://cve.now/CVE-2025-1159.md): CampCodes School Management Software academic-calendar cross site scripting (CVSS 5.1, CampCodes School Management Software)
- [CVE-2025-24970](https://cve.now/CVE-2025-24970.md): SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine (CVSS 7.5, netty · io.netty:netty-handler)
- [CVE-2025-1158](https://cve.now/CVE-2025-1158.md): ESAFENET CDG addPolicyToSafetyGroup.jsp sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2025-1157](https://cve.now/CVE-2025-1157.md): Allims lab.online model\_recuperar\_senha.php sql injection (CVSS 5.3, Allims lab.online)
- [CVE-2025-1002](https://cve.now/CVE-2025-1002.md): MicroDicom DICOM Viewer Improper Certificate Validation (CVSS 5.7, MicroDicom DICOM Viewer)
- [CVE-2025-1156](https://cve.now/CVE-2025-1156.md): Pix Software Vivaz servlet sql injection (CVSS 6.9, Pix Software Vivaz)
- [CVE-2025-1155](https://cve.now/CVE-2025-1155.md): Webkul QloApps Your Location Search stores cross site scripting (CVSS 5.3, Webkul QloApps)
- [CVE-2025-1154](https://cve.now/CVE-2025-1154.md): xxyopen Novel books sql injection (CVSS 5.3, xxyopen Novel)
- [CVE-2025-24016](https://cve.now/CVE-2025-24016.md): Remote code execution in Wazuh server (CVSS 9.9, KEV, wazuh · github.com/wazuh/wazuh)
- [CVE-2025-24200](https://cve.now/CVE-2025-24200.md): An authorization issue was addressed with improved state management. (CVSS 6.1, KEV, Apple iOS and iPadOS · Apple iPadOS)
- [CVE-2025-1153](https://cve.now/CVE-2025-1153.md): GNU Binutils format.c bfd\_set\_format memory corruption (CVSS 2.3, GNU Binutils)
- [CVE-2024-13059](https://cve.now/CVE-2024-13059.md): Path Traversal in mintplex-labs/anything-llm (CVSS 7.2, mintplex-labs/anything-llm)
- [CVE-2024-10649](https://cve.now/CVE-2024-10649.md): Unauthenticated File Upload in wandb/openui (CVSS 6.1, wandb/openui)
- [CVE-2024-8550](https://cve.now/CVE-2024-8550.md): Local File Inclusion (LFI) in modelscope/agentscope (CVSS 7.5, modelscope/agentscope · agentscope)
- [CVE-2024-13010](https://cve.now/CVE-2024-13010.md): WP Foodbakery \<= 4.8 - Reflected Cross-Site Scripting (CVSS 6.1, Chimpstudio WP Foodbakery)
- [CVE-2024-13011](https://cve.now/CVE-2024-13011.md): WP Foodbakery \<= 4.7 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Chimpstudio WP Foodbakery)
- [CVE-2024-27859](https://cve.now/CVE-2024-27859.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-54658](https://cve.now/CVE-2024-54658.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-1152](https://cve.now/CVE-2025-1152.md): GNU Binutils ld xstrdup.c xstrdup memory leak (CVSS 2.3, GNU Binutils)
- [CVE-2025-25188](https://cve.now/CVE-2025-25188.md): DNSSEC validation may accept broken authentication chains (CVSS 5.7, hickory-dns · hickory-proto)
- [CVE-2025-1151](https://cve.now/CVE-2025-1151.md): GNU Binutils ld xmemdup.c xmemdup memory leak (CVSS 2.3, GNU Binutils)
- [CVE-2025-1150](https://cve.now/CVE-2025-1150.md): GNU Binutils ld libbfd.c bfd\_malloc memory leak (CVSS 2.3, GNU Binutils)
- [CVE-2025-21693](https://cve.now/CVE-2025-21693.md): mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVSS 7.8, Linux)
- [CVE-2025-21692](https://cve.now/CVE-2025-21692.md): net: sched: fix ets qdisc OOB Indexing (CVSS 7.8, Linux)
- [CVE-2025-21691](https://cve.now/CVE-2025-21691.md): cachestat: fix page cache statistics permission checking (no CVSS, Linux)
- [CVE-2025-21690](https://cve.now/CVE-2025-21690.md): scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (CVSS 5.5, Linux)
- [CVE-2025-21689](https://cve.now/CVE-2025-21689.md): USB: serial: quatech2: fix null-ptr-deref in qt2\_process\_read\_urb() (CVSS 5.5, Linux)
- [CVE-2025-21688](https://cve.now/CVE-2025-21688.md): drm/v3d: Assign job pointer to NULL before signaling the fence (CVSS 4.7, Linux)
- [CVE-2025-21687](https://cve.now/CVE-2025-21687.md): vfio/platform: check the bounds of read/write syscalls (CVSS 7.8, Linux)
- [CVE-2024-57950](https://cve.now/CVE-2024-57950.md): drm/amd/display: Initialize denominator defaults to 1 (CVSS 5.5, Linux)
- [CVE-2025-25186](https://cve.now/CVE-2025-25186.md): Net::IMAP vulnerable to possible DoS by memory exhaustion (CVSS 6.5, ruby net-imap · net-imap)
- [CVE-2025-24892](https://cve.now/CVE-2025-24892.md): OpenProject stored HTML injection vulnerability (CVSS 3.5, opf openproject)
- [CVE-2025-24032](https://cve.now/CVE-2025-24032.md): PAM-PKCS#11 vulnerable to authentication bypass with default value for \`cert\_policy\` (\`none\`) (CVSS 9.2, OpenSC pam\_pkcs11)
- [CVE-2025-24031](https://cve.now/CVE-2025-24031.md): PAM-PKCS#11 vulnerable to segmentation fault on ctrl-c/ctrl-d when asked for PIN (CVSS 5.1, OpenSC pam\_pkcs11)
- [CVE-2024-12243](https://cve.now/CVE-2024-12243.md): Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos (CVSS 5.3, gnutls · Red Hat Enterprise Linux +2)
- [CVE-2024-12133](https://cve.now/CVE-2024-12133.md): Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos (CVSS 5.3, libtasn1 · Red Hat Enterprise Linux +2)
- [CVE-2024-11831](https://cve.now/CVE-2024-11831.md): Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript (CVSS 5.4, serialize-javascript · Red Hat Advanced Cluster Security +36)
- [CVE-2024-10334](https://cve.now/CVE-2024-10334.md): Camera passwords stored in clear text (CVSS 7.0, ABB System 800xA)
- [CVE-2025-1149](https://cve.now/CVE-2025-1149.md): GNU Binutils ld xmalloc.c xstrdup memory leak (CVSS 2.3, GNU Binutils)
- [CVE-2025-1148](https://cve.now/CVE-2025-1148.md): GNU Binutils ld ldelfgen.c link\_order\_scan memory leak (CVSS 2.3, GNU Binutils)
- [CVE-2024-11621](https://cve.now/CVE-2024-11621.md): Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modif (CVSS 8.8, Devolutions Remote Desktop Manager)
- [CVE-2025-1193](https://cve.now/CVE-2025-1193.md): Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows a (CVSS 8.1, Devolutions Remote Desktop Manager)
- [CVE-2025-1147](https://cve.now/CVE-2025-1147.md): GNU Binutils nm nm.c internal\_strlen buffer overflow (CVSS 2.3, GNU Binutils)
- [CVE-2024-8685](https://cve.now/CVE-2024-8685.md): Path-Traversal vulnerability in Revolution Pi (CVSS 4.3, KUNBUS Revolution Pi)
- [CVE-2024-8684](https://cve.now/CVE-2024-8684.md): OS Command Injection vulnerability in Revolution Pi (CVSS 8.3, KUNBUS Revolution Pi)
- [CVE-2025-1175](https://cve.now/CVE-2025-1175.md): Cross-Site Scripting (XSS) vulnerability in Kelio Visio (CVSS 6.1, Kelio Visio)
- [CVE-2025-25247](https://cve.now/CVE-2025-25247.md): Apache Felix Webconsole: XSS in services console (CVSS 6.1, Apache Software Foundation Apache Felix Webconsole · org.ap…)
- [CVE-2025-1099](https://cve.now/CVE-2025-1099.md): Information Disclosure Vulnerability in TP-Link Tapo C500 Wi-Fi Camera (CVSS 7.0, TP-Link Tapo C500 V1 Wi-Fi Camera · TP-Link Tapo C500 V2 Wi…)
- [CVE-2024-42512](https://cve.now/CVE-2024-42512.md): Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when (CVSS 8.6, OPCFoundation.NetStandard.Opc.Ua.Core)
- [CVE-2024-42513](https://cve.now/CVE-2024-42513.md): Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when (CVSS 5.3, OPCFoundation.NetStandard.Opc.Ua.Bindings.Https)
- [CVE-2024-46429](https://cve.now/CVE-2024-46429.md): A hardcoded credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management po (CVSS 8.8)
- [CVE-2024-46430](https://cve.now/CVE-2024-46430.md): Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. (CVSS 6.5)
- [CVE-2024-46431](https://cve.now/CVE-2024-46431.md): Tenda W18E V16.01.0.8(1625) is vulnerable to Buffer Overflow. (CVSS 8.0)
- [CVE-2024-46432](https://cve.now/CVE-2024-46432.md): Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. (CVSS 8.8)
- [CVE-2024-46433](https://cve.now/CVE-2024-46433.md): A default credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management port (CVSS 8.8)
- [CVE-2024-46434](https://cve.now/CVE-2024-46434.md): Tenda W18E V16.01.0.8(1625) suffers from authentication bypass in the web management portal allowing an unauthorized remote attacker to gain (CVSS 8.8)
- [CVE-2024-46435](https://cve.now/CVE-2024-46435.md): A stack overflow vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an authenticated remote attacker to cause a d (CVSS 8.0)
- [CVE-2024-46436](https://cve.now/CVE-2024-46436.md): Hardcoded credentials in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to gain root access to the device over the teln (CVSS 8.3)
- [CVE-2024-46437](https://cve.now/CVE-2024-46437.md): A sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an unauthenticated remote a (CVSS 6.5)
- [CVE-2024-48170](https://cve.now/CVE-2024-48170.md): PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload injected into the name in the profile.php. (CVSS 5.4)
- [CVE-2024-54954](https://cve.now/CVE-2024-54954.md): OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department. (CVSS 8.0)
- [CVE-2024-57177](https://cve.now/CVE-2024-57177.md): A host header injection vulnerability exists in the NPM package of perfood/couch-auth \<= 0.21.2. (CVSS 7.3, @perfood/couch-auth)
- [CVE-2024-57178](https://cve.now/CVE-2024-57178.md): An SQL injection vulnerability exists in Stock-Forecaster \<=01-04-2020. (CVSS 5.9)
- [CVE-2024-57407](https://cve.now/CVE-2024-57407.md): An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading (CVSS 7.3)
- [CVE-2024-57408](https://cve.now/CVE-2024-57408.md): An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via (CVSS 7.2)
- [CVE-2024-57409](https://cve.now/CVE-2024-57409.md): A stored cross-site scripting (XSS) vulnerability in the Parameter List module of cool-admin-java v1.0 allows attackers to execute arbitrary (CVSS 4.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.