# CVEs published 2025-02-12

262 CVEs were published on February 12, 2025: 25 critical, 87 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-31631](https://cve.now/CVE-2022-31631.md): PDO::quote() may return unquoted string (CVSS 9.1, PHP Group PHP)
- [CVE-2025-1229](https://cve.now/CVE-2025-1229.md): olajowon Loggrove page os command injection (CVSS 5.3, olajowon Loggrove)
- [CVE-2024-41168](https://cve.now/CVE-2024-41168.md): Use after free in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticat (CVSS 7.1, Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software…)
- [CVE-2025-1228](https://cve.now/CVE-2025-1228.md): olajowon Loggrove Logfile Update page path traversal (CVSS 5.3, olajowon Loggrove)
- [CVE-2024-31068](https://cve.now/CVE-2024-31068.md): Improper Finite State Machines (FSMs) in Hardware Logic for some Intel(R) Processors may allow privileged user to potentially enable denial (CVSS 5.6, Intel(R) Processors)
- [CVE-2024-36262](https://cve.now/CVE-2024-36262.md): Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enab (CVSS 8.6, Intel(R) System Security Report and System Resources Defens…)
- [CVE-2023-49618](https://cve.now/CVE-2023-49618.md): Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to po (CVSS 8.7, Intel(R) System Security Report and System Resources Defens…)
- [CVE-2023-49615](https://cve.now/CVE-2023-49615.md): Improper input validation in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to poten (CVSS 8.7, Intel(R) System Security Report and System Resources Defens…)
- [CVE-2023-49603](https://cve.now/CVE-2023-49603.md): Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enab (CVSS 8.7, Intel(R) System Security Report and System Resources Defens…)
- [CVE-2023-48366](https://cve.now/CVE-2023-48366.md): Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enab (CVSS 5.6, Intel(R) System Security Report and System Resources Defens…)
- [CVE-2023-48267](https://cve.now/CVE-2023-48267.md): Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to po (CVSS 8.6, Intel(R) System Security Report and System Resources Defens…)
- [CVE-2024-36293](https://cve.now/CVE-2024-36293.md): Improper access control in the EDECCSSA user leaf function for some Intel(R) Processors with Intel(R) SGX may allow an authenticated user to (CVSS 6.8, Intel(R) Processors with Intel(R) SGX)
- [CVE-2024-39271](https://cve.now/CVE-2024-39271.md): Improper restriction of communication channel to intended endpoints in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software before (CVSS 2.0, Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software)
- [CVE-2024-36285](https://cve.now/CVE-2024-36285.md): Race condition in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an authenticated (CVSS 5.7, Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software…)
- [CVE-2024-41166](https://cve.now/CVE-2024-41166.md): Stack-based buffer overflow in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an (CVSS 6.0, Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software…)
- [CVE-2024-40887](https://cve.now/CVE-2024-40887.md): Race condition in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticat (CVSS 6.0, Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software…)
- [CVE-2024-39606](https://cve.now/CVE-2024-39606.md): Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an un (CVSS 6.0, Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software…)
- [CVE-2024-39356](https://cve.now/CVE-2024-39356.md): NULL pointer dereference in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an una (CVSS 7.1, Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software…)
- [CVE-2024-37020](https://cve.now/CVE-2024-37020.md): Sequence of processor instructions leads to unexpected behavior in the Intel(R) DSA V1.0 for some Intel(R) Xeon(R) Processors may allow an a (CVSS 4.9, Intel(R) Xeon(R) Processors)
- [CVE-2024-39365](https://cve.now/CVE-2024-39365.md): Uncontrolled search path for the FPGA Support Package for the Intel(R) oneAPI DPC++/C++ Compiler software for Windows before version 2024.2 (CVSS 5.4, Intel(R) oneAPI DPC++/C++ Compiler software for Windows)
- [CVE-2024-42405](https://cve.now/CVE-2024-42405.md): Uncontrolled search path for some Intel(R) Quartus(R) Prime Software before version 23.1.1 Patch 1.01std may allow an authenticated user to (CVSS 5.4, Intel(R) Quartus(R) Prime Software)
- [CVE-2024-36283](https://cve.now/CVE-2024-36283.md): Uncontrolled search path for the Intel(R) Thread Director Visualizer software before version 1.0.1 may allow an authenticated user to potent (CVSS 5.4, Intel(R) Thread Director Visualizer software)
- [CVE-2024-32941](https://cve.now/CVE-2024-32941.md): NULL pointer dereference for some Intel(R) MLC software before version v3.11b may allow an authenticated user to potentially enable denial o (CVSS 6.9, Intel(R) MLC software)
- [CVE-2024-47006](https://cve.now/CVE-2024-47006.md): Uncontrolled search path for the Intel(R) RealSense D400 Series Universal Windows Platform (UWP) Driver for Windows(R) 10 all versions may a (CVSS 5.4, Intel(R) RealSense D400 Series)
- [CVE-2024-39805](https://cve.now/CVE-2024-39805.md): Insufficient verification of data authenticity in some Intel(R) DSA software before version 23.4.39 may allow an authenticated user to poten (CVSS 7.3, Intel(R) DSA software)
- [CVE-2024-32942](https://cve.now/CVE-2024-32942.md): Incorrect default permissions for some Intel(R) DSA installer for Windows before version 24.2.19.5 may allow an authenticated user to potent (CVSS 5.4, Intel(R) DSA installer for Windows)
- [CVE-2024-36280](https://cve.now/CVE-2024-36280.md): Uncontrolled search path for some Intel(R) High Level Synthesis Compiler software before version 24.2 may allow an authenticated user to pot (CVSS 5.4, Intel(R) High Level Synthesis Compiler software)
- [CVE-2024-39372](https://cve.now/CVE-2024-39372.md): Uncontrolled search path for the Intel(R) XTU software for Windows before version 7.14.2.14 may allow an authenticated user to potentially e (CVSS 5.4, Intel(R) XTU software for Windows)
- [CVE-2025-20097](https://cve.now/CVE-2025-20097.md): Uncaught exception in OpenBMC Firmware for the Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Family before version R01.02.0002 ma (CVSS 5.3, Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Fa…)
- [CVE-2023-29164](https://cve.now/CVE-2023-29164.md): Improper access control in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP, (CVSS 5.8, Intel(R) Server Board S2600WF, Intel(R) Server Board S2600S…)
- [CVE-2023-31276](https://cve.now/CVE-2023-31276.md): Heap-based buffer overflow in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600 (CVSS 8.4, Intel(R) Server Board S2600WF, Intel(R) Server Board S2600S…)
- [CVE-2024-39355](https://cve.now/CVE-2024-39355.md): Improper handling of physical or environmental conditions in some Intel(R) Processors may allow an authenticated user to enable denial of se (CVSS 5.7, Intel(R) Processors)
- [CVE-2024-25571](https://cve.now/CVE-2024-25571.md): Improper input validation in some Intel(R) SPS firmware before SPS\_E5\_06.01.04.059.0 may allow a privileged user to potentially enable denia (CVSS 4.6, Intel(R) SPS firmware before SPS\_E5\_06.01.04.059.0)
- [CVE-2024-28047](https://cve.now/CVE-2024-28047.md): Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclo (CVSS 6.8, Intel(R) Processors)
- [CVE-2024-31157](https://cve.now/CVE-2024-31157.md): Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable i (CVSS 6.8, Intel(R) Processors)
- [CVE-2024-39279](https://cve.now/CVE-2024-39279.md): Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enable (CVSS 6.8, Intel(R) processors)
- [CVE-2024-28127](https://cve.now/CVE-2024-28127.md): Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of priv (CVSS 8.7, Intel(R) Processors)
- [CVE-2024-29214](https://cve.now/CVE-2024-29214.md): Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged user to potentially ena (CVSS 8.7, Intel(R) Processors)
- [CVE-2024-24582](https://cve.now/CVE-2024-24582.md): Improper input validation in XmlCli feature for UEFI firmware for some Intel(R) processors may allow privileged user to potentially enable e (CVSS 8.7, Intel(R) processors)
- [CVE-2023-34440](https://cve.now/CVE-2023-34440.md): Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of priv (CVSS 8.7, Intel(R) Processors)
- [CVE-2023-43758](https://cve.now/CVE-2023-43758.md): Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of priv (CVSS 8.7, Intel(R) processors)
- [CVE-2024-26021](https://cve.now/CVE-2024-26021.md): Improper initialization in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially (CVSS 4.6, Intel(R) AMT and Intel(R) Standard Manageability)
- [CVE-2024-30211](https://cve.now/CVE-2024-30211.md): Improper access control in some Intel(R) ME driver pack installer engines before version 2422.6.2.0 may allow an authenticated user to poten (CVSS 5.3, Intel(R) ME driver pack installer engines)
- [CVE-2024-38307](https://cve.now/CVE-2024-38307.md): Improper input validation in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow an authenticated user to poten (CVSS 7.1, Intel(R) AMT and Intel(R) Standard Manageability)
- [CVE-2024-21859](https://cve.now/CVE-2024-21859.md): Improper buffer restrictions in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information (CVSS 6.8, Intel(R) Processors)
- [CVE-2024-31155](https://cve.now/CVE-2024-31155.md): Improper buffer restrictions in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation (CVSS 8.7, Intel(R) Processors)
- [CVE-2024-39779](https://cve.now/CVE-2024-39779.md): Stack-based buffer overflow in some drivers for Intel(R) Ethernet Connection I219 Series before version 12.19.1.39 may allow an authenticate (CVSS 5.7, Intel(R) Ethernet Connection I219 Series)
- [CVE-2024-39797](https://cve.now/CVE-2024-39797.md): Improper access control in some drivers for Intel(R) Ethernet Connection I219 Series before version 12.19.1.39 may allow an authenticated us (CVSS 5.7, Intel(R) Ethernet Connection I219 Series)
- [CVE-2024-36274](https://cve.now/CVE-2024-36274.md): Out-of-bounds write in the Intel(R) 800 Series Ethernet Driver for Intel(R) Ethernet Adapter Complete Driver Pack before versions 29.1 may a (CVSS 7.1, Intel(R) 800 Series Ethernet Driver for Intel(R) Ethernet A…)
- [CVE-2024-24852](https://cve.now/CVE-2024-24852.md): Uncontrolled search path in some Intel(R) Ethernet Adapter Complete Driver Pack install before versions 29.1 may allow an authenticated user (CVSS 5.4, Intel(R) Ethernet Adapter Complete Driver Pack)
- [CVE-2024-36291](https://cve.now/CVE-2024-36291.md): Uncontrolled search path for some Intel(R) Chipset Software Installation Utility before version 10.1.19867.8574 may allow an authenticated u (CVSS 5.4, Intel(R) Chipset Software Installation Utility)
- [CVE-2024-32938](https://cve.now/CVE-2024-32938.md): Uncontrolled search path for some Intel(R) MPI Library for Windows software before version 2021.13 may allow an authenticated user to potent (CVSS 5.4, Intel(R) MPI Library for Windows software)
- [CVE-2024-39284](https://cve.now/CVE-2024-39284.md): Uncontrolled search path for some Intel(R) Advisor software before version 2024.2 may allow an authenticated user to potentially enable esca (CVSS 5.4, Intel(R) Advisor software)
- [CVE-2024-39813](https://cve.now/CVE-2024-39813.md): Uncontrolled search path for some EPCT software before version 1.42.8.0 may allow an authenticated user to potentially enable escalation of (CVSS 5.4, EPCT software)
- [CVE-2024-41917](https://cve.now/CVE-2024-41917.md): Time-of-check time-of-use race condition for some Intel(R) Battery Life Diagnostic Tool software before version 2.4.1 may allow an authentic (CVSS 5.4, Intel(R) Battery Life Diagnostic Tool software)
- [CVE-2024-39286](https://cve.now/CVE-2024-39286.md): Incorrect execution-assigned permissions in the Linux kernel mode driver for the Intel(R) 800 Series Ethernet Driver before version 1.15.4 m (CVSS 2.0, Intel(R) 800 Series Ethernet Driver)
- [CVE-2024-42492](https://cve.now/CVE-2024-42492.md): Uncontrolled search path element in some BIOS and System Firmware Update Package for Intel(R) Server M50FCP family before version R01.02.000 (CVSS 5.4, BIOS and System Firmware Update Package for Intel(R) Server…)
- [CVE-2024-21830](https://cve.now/CVE-2024-21830.md): Uncontrolled search path in some Intel(R) VPL software before version 2023.4.0 may allow an authenticated user to potentially enable escalat (CVSS 5.4, Intel(R) VPL software)
- [CVE-2024-41934](https://cve.now/CVE-2024-41934.md): Improper access control in some Intel(R) GPA software before version 2024.3 may allow an authenticated user to potentially enable denial of (CVSS 4.1, Intel(R) GPA software)
- [CVE-2024-42419](https://cve.now/CVE-2024-42419.md): Incorrect default permissions for some Intel(R) GPA and Intel(R) GPA Framework software installers may allow an authenticated user to potent (CVSS 5.4, Intel(R) GPA and Intel(R) GPA Framework software installers)
- [CVE-2024-42410](https://cve.now/CVE-2024-42410.md): Improper input validation in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via loca (CVSS 6.8, Intel(R) Graphics Drivers)
- [CVE-2024-38310](https://cve.now/CVE-2024-38310.md): Improper access control in some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable escalatio (CVSS 5.4, Intel(R) Graphics Driver software installers)
- [CVE-2024-37355](https://cve.now/CVE-2024-37355.md): Improper access control in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege via (CVSS 8.5, Intel(R) Graphics software)
- [CVE-2024-31153](https://cve.now/CVE-2024-31153.md): Improper input validation for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentia (CVSS 5.1, Intel(R) QuickAssist Technology software)
- [CVE-2023-32277](https://cve.now/CVE-2023-32277.md): Untrusted Pointer Dereference in I/O subsystem for some Intel(R) QAT software before version 2.0.5 may allow authenticated user to potential (CVSS 4.3, Intel(R) QAT software)
- [CVE-2024-29223](https://cve.now/CVE-2024-29223.md): Uncontrolled search path for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potential (CVSS 5.4, Intel(R) QuickAssist Technology software)
- [CVE-2024-31858](https://cve.now/CVE-2024-31858.md): Out-of-bounds write for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially en (CVSS 7.3, Intel(R) QuickAssist Technology software)
- [CVE-2025-0113](https://cve.now/CVE-2025-0113.md): Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker Containers (CVSS 5.3, Palo Alto Networks Cortex XDR Broker VM)
- [CVE-2025-0110](https://cve.now/CVE-2025-0110.md): PAN-OS OpenConfig Plugin: Command Injection Vulnerability in OpenConfig Plugin (CVSS 8.6, Palo Alto Networks PAN-OS OpenConfig Plugin)
- [CVE-2025-1227](https://cve.now/CVE-2025-1227.md): ywoa AddressDao.xml selectList sql injection (CVSS 5.3, ywoa)
- [CVE-2025-0111](https://cve.now/CVE-2025-0111.md): PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface (CVSS 7.1, KEV, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-0109](https://cve.now/CVE-2025-0109.md): PAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web Interface (CVSS 6.9, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-0108](https://cve.now/CVE-2025-0108.md): PAN-OS: Authentication Bypass in the Management Web Interface (CVSS 8.8, KEV, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2024-12673](https://cve.now/CVE-2024-12673.md): An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allow (CVSS 7.8, Lenovo Vantage)
- [CVE-2025-1226](https://cve.now/CVE-2025-1226.md): ywoa setup.jsp improper authorization (CVSS 6.9, ywoa)
- [CVE-2025-1225](https://cve.now/CVE-2025-1225.md): ywoa WXCallBack Interface XMLParse.java extract xml external entity reference (CVSS 5.3, ywoa)
- [CVE-2025-1224](https://cve.now/CVE-2025-1224.md): ywoa UserMapper.xml listNameBySql sql injection (CVSS 5.3, ywoa)
- [CVE-2025-1216](https://cve.now/CVE-2025-1216.md): ywoa OaNoticeMapper.xml selectNoticeList sql injection (CVSS 5.3, ywoa)
- [CVE-2025-0937](https://cve.now/CVE-2025-0937.md): Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace (CVSS 7.1, HashiCorp Nomad)
- [CVE-2025-1215](https://cve.now/CVE-2025-1215.md): vim main.c memory corruption (CVSS 2.4, vim)
- [CVE-2025-1146](https://cve.now/CVE-2025-1146.md): CrowdStrike Falcon Sensor for Linux TLS Issue (CVSS 8.1, CrowdStrike Falcon sensor for Linux · CrowdStrike Falcon… +1)
- [CVE-2025-25283](https://cve.now/CVE-2025-25283.md): parse-duraton vulnerable to Regex Denial of Service that results in event loop delay and out of memory (CVSS 7.5, jkroso parse-duration · parse-duration)
- [CVE-2025-25205](https://cve.now/CVE-2025-25205.md): Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching (CVSS 8.2, advplyr audiobookshelf)
- [CVE-2025-25201](https://cve.now/CVE-2025-25201.md): Improper Validation of Admin Key in PIV Smartcard (CVSS 4.0, nitrokey-3-firmware)
- [CVE-2025-1214](https://cve.now/CVE-2025-1214.md): pihome-shc PiHome Role-Based Access Control user\_accounts.php authorization (CVSS 5.3, pihome-shc PiHome)
- [CVE-2025-25200](https://cve.now/CVE-2025-25200.md): Koa has Inefficient Regular Expression Complexity (CVSS 9.2, koajs koa · koa)
- [CVE-2025-25199](https://cve.now/CVE-2025-25199.md): BCryptGenerateSymmetricKey memory leak (CVSS 7.5, microsoft go-crypto-winnative · github.com/microsoft/go-cry…)
- [CVE-2025-25198](https://cve.now/CVE-2025-25198.md): mailcow: dockerized vulnerable to password reset poisoning (CVSS 7.1, mailcow-dockerized)
- [CVE-2024-6097](https://cve.now/CVE-2024-6097.md): Absolute Path Traversal Vulnerability (CVSS 5.3, Progress Software Progress® Telerik® Reporting)
- [CVE-2025-1213](https://cve.now/CVE-2025-1213.md): pihome-shc PiHome index.php cross site scripting (CVSS 5.1, pihome-shc PiHome)
- [CVE-2025-1210](https://cve.now/CVE-2025-1210.md): code-projects Wazifa System control.php sql injection (CVSS 5.3, code-projects Wazifa System)
- [CVE-2025-1209](https://cve.now/CVE-2025-1209.md): code-projects Wazifa System search\_resualts.php searchuser cross site scripting (CVSS 5.1, code-projects Wazifa System)
- [CVE-2024-11629](https://cve.now/CVE-2024-11629.md): Telerik Document Processing RTF Export of Arbitrary File Path (CVSS 7.1, Progress Software Progress® Telerik® Document Processing Li…)
- [CVE-2025-25184](https://cve.now/CVE-2025-25184.md): Possible Log Injection in Rack::CommonLogger (CVSS 5.7, rack)
- [CVE-2024-11628](https://cve.now/CVE-2024-11628.md): Prototype Pollution in Progress® Telerik® Kendo UI for Vue (CVSS 4.1, Progress Software Progress® Telerik® Kendo UI for Vue)
- [CVE-2025-25182](https://cve.now/CVE-2025-25182.md): Stroom Authentication/Authorization Bypass when using AWS ALB (CVSS 9.4, gchq stroom)
- [CVE-2025-1208](https://cve.now/CVE-2025-1208.md): code-projects Wazifa System Profile.php cross site scripting (CVSS 5.1, code-projects Wazifa System)
- [CVE-2024-11343](https://cve.now/CVE-2024-11343.md): Telerik Document Processing Path Traversal (CVSS 8.3, Progress Software Telerik Document Processing Libraries)
- [CVE-2024-12629](https://cve.now/CVE-2024-12629.md): Prototype Pollution in Progress® Telerik® KendoReact (CVSS 4.1, Progress Software Telerik KendoReact)
- [CVE-2025-1207](https://cve.now/CVE-2025-1207.md): phjounin TFTPD64 DNS denial of service (CVSS 2.3, phjounin TFTPD64)
- [CVE-2024-9870](https://cve.now/CVE-2024-9870.md): Unintended Proxy or Intermediary ('Confused Deputy') in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-0516](https://cve.now/CVE-2025-0516.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-0332](https://cve.now/CVE-2025-0332.md): Progress UI for WinForms decompression path traversal vulnerability (CVSS 7.8, Progress Software Progress® Telerik® UI for WinForms)
- [CVE-2025-0556](https://cve.now/CVE-2025-0556.md): Telerik Report Server Clear Text Transmission of Agent Commands (CVSS 8.8, Progress Software Telerik Report Server)
- [CVE-2024-12251](https://cve.now/CVE-2024-12251.md): Improper neutralization special element in hyperlinks (CVSS 7.8, Progress Software Telerik UI for WinUI)
- [CVE-2024-12379](https://cve.now/CVE-2024-12379.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-0376](https://cve.now/CVE-2025-0376.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-1212](https://cve.now/CVE-2025-1212.md): Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-1042](https://cve.now/CVE-2025-1042.md): Files or Directories Accessible to External Parties in GitLab (CVSS 4.9, GitLab)
- [CVE-2025-1206](https://cve.now/CVE-2025-1206.md): Codezips Gym Management System viewdetailroutine.php sql injection (CVSS 5.3, Codezips Gym Management System)
- [CVE-2025-1202](https://cve.now/CVE-2025-1202.md): SourceCodester Best Church Management Software edit\_slider.php sql injection (CVSS 5.3, SourceCodester Best Church Management Software)
- [CVE-2025-1244](https://cve.now/CVE-2025-1244.md): Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme (CVSS 8.8, emacs · Red Hat Enterprise Linux 7 Extended Lifecycle Su… +2)
- [CVE-2025-1201](https://cve.now/CVE-2025-1201.md): SourceCodester Best Church Management Software profile\_crud.php sql injection (CVSS 5.3, SourceCodester Best Church Management Software)
- [CVE-2025-21699](https://cve.now/CVE-2025-21699.md): gfs2: Truncate address space when flipping GFS2\_DIF\_JDATA flag (CVSS 7.8, Linux)
- [CVE-2024-57952](https://cve.now/CVE-2024-57952.md): Revert "libfs: fix infinite directory reads for offset dir" (CVSS 7.1, Linux)
- [CVE-2024-23563](https://cve.now/CVE-2024-23563.md): HCL Connections Docs is vulnerable to a sensitive information disclosure (CVSS 3.9, HCL Software Connections Docs)
- [CVE-2025-1200](https://cve.now/CVE-2025-1200.md): SourceCodester Best Church Management Software slider\_crud.php sql injection (CVSS 5.3, SourceCodester Best Church Management Software)
- [CVE-2025-26378](https://cve.now/CVE-2025-26378.md): A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authentica (CVSS 8.8, Q-Free MaxTime)
- [CVE-2025-26377](https://cve.now/CVE-2025-26377.md): A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authentica (CVSS 8.1, Q-Free MaxTime)
- [CVE-2025-26376](https://cve.now/CVE-2025-26376.md): A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authentica (CVSS 6.5, Q-Free MaxTime)
- [CVE-2025-26375](https://cve.now/CVE-2025-26375.md): A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authentica (CVSS 8.8, Q-Free MaxTime)
- [CVE-2025-26374](https://cve.now/CVE-2025-26374.md): A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 all (CVSS 6.5, Q-Free MaxTime)
- [CVE-2025-26373](https://cve.now/CVE-2025-26373.md): A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allo (CVSS 6.5, Q-Free MaxTime)
- [CVE-2025-26372](https://cve.now/CVE-2025-26372.md): A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an auth (CVSS 7.1, Q-Free MaxTime)
- [CVE-2025-26371](https://cve.now/CVE-2025-26371.md): A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an auth (CVSS 8.8, Q-Free MaxTime)
- [CVE-2025-26370](https://cve.now/CVE-2025-26370.md): A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an auth (CVSS 7.1, Q-Free MaxTime)
- [CVE-2025-26369](https://cve.now/CVE-2025-26369.md): A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an auth (CVSS 8.8, Q-Free MaxTime)
- [CVE-2025-26368](https://cve.now/CVE-2025-26368.md): A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an auth (CVSS 8.1, Q-Free MaxTime)
- [CVE-2025-26367](https://cve.now/CVE-2025-26367.md): A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an auth (CVSS 4.3, Q-Free MaxTime)
- [CVE-2025-26366](https://cve.now/CVE-2025-26366.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11 (CVSS 7.5, Q-Free MaxTime)
- [CVE-2025-26365](https://cve.now/CVE-2025-26365.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11 (CVSS 7.5, Q-Free MaxTime)
- [CVE-2025-26364](https://cve.now/CVE-2025-26364.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11 (CVSS 7.5, Q-Free MaxTime)
- [CVE-2025-26363](https://cve.now/CVE-2025-26363.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11 (CVSS 7.5, Q-Free MaxTime)
- [CVE-2025-26362](https://cve.now/CVE-2025-26362.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11 (CVSS 7.5, Q-Free MaxTime)
- [CVE-2025-26361](https://cve.now/CVE-2025-26361.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11 (CVSS 9.1, Q-Free MaxTime)
- [CVE-2025-26360](https://cve.now/CVE-2025-26360.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to versio (CVSS 5.3, Q-Free MaxTime)
- [CVE-2025-26359](https://cve.now/CVE-2025-26359.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2 (CVSS 9.8, Q-Free MaxTime)
- [CVE-2025-26358](https://cve.now/CVE-2025-26358.md): A CWE-15 "External Control of System or Configuration Setting" in ldbMT.so in Q-Free MaxTime less than or equal to version 2.11.0 allows an (CVSS 5.5, Q-Free MaxTime)
- [CVE-2025-26357](https://cve.now/CVE-2025-26357.md): A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticate (CVSS 4.9, Q-Free MaxTime)
- [CVE-2025-26356](https://cve.now/CVE-2025-26356.md): A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 a (CVSS 7.2, Q-Free MaxTime)
- [CVE-2025-26355](https://cve.now/CVE-2025-26355.md): A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticate (CVSS 6.5, Q-Free MaxTime)
- [CVE-2025-26354](https://cve.now/CVE-2025-26354.md): A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows (CVSS 7.2, Q-Free MaxTime)
- [CVE-2025-26353](https://cve.now/CVE-2025-26353.md): A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote a (CVSS 4.9, Q-Free MaxTime)
- [CVE-2025-26352](https://cve.now/CVE-2025-26352.md): A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (CVSS 6.5, Q-Free MaxTime)
- [CVE-2025-26351](https://cve.now/CVE-2025-26351.md): A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (CVSS 4.9, Q-Free MaxTime)
- [CVE-2025-26350](https://cve.now/CVE-2025-26350.md): A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.1 (CVSS 4.9, Q-Free MaxTime)
- [CVE-2025-26349](https://cve.now/CVE-2025-26349.md): A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticat (CVSS 7.2, Q-Free MaxTime)
- [CVE-2025-21697](https://cve.now/CVE-2025-21697.md): drm/v3d: Ensure job pointer is set to NULL after job completion (CVSS 7.8, Linux)
- [CVE-2025-21696](https://cve.now/CVE-2025-21696.md): mm: clear uffd-wp PTE/PMD state on mremap() (CVSS 5.5, Linux)
- [CVE-2025-21695](https://cve.now/CVE-2025-21695.md): platform/x86: dell-uart-backlight: fix serdev race (CVSS 4.7, Linux)
- [CVE-2025-26348](https://cve.now/CVE-2025-26348.md): A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu e (CVSS 5.5, Q-Free MaxTime)
- [CVE-2025-21694](https://cve.now/CVE-2025-21694.md): fs/proc: fix softlockup in \_\_read\_vmcore (part 2) (CVSS 5.5, Linux)
- [CVE-2024-57951](https://cve.now/CVE-2024-57951.md): hrtimers: Handle CPU state correctly on hotplug (CVSS 7.8, Linux)
- [CVE-2025-26347](https://cve.now/CVE-2025-26347.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11. (CVSS 9.8, Q-Free MaxTime)
- [CVE-2025-26346](https://cve.now/CVE-2025-26346.md): A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupM (CVSS 5.5, Q-Free MaxTime)
- [CVE-2025-26345](https://cve.now/CVE-2025-26345.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11. (CVSS 9.8, Q-Free MaxTime)
- [CVE-2025-26344](https://cve.now/CVE-2025-26344.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version (CVSS 9.8, Q-Free MaxTime)
- [CVE-2025-26343](https://cve.now/CVE-2025-26343.md): A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth (CVSS 8.1, Q-Free MaxTime)
- [CVE-2025-26342](https://cve.now/CVE-2025-26342.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2 (CVSS 9.8, Q-Free MaxTime)
- [CVE-2025-26341](https://cve.now/CVE-2025-26341.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2 (CVSS 9.8, Q-Free MaxTime)
- [CVE-2025-26340](https://cve.now/CVE-2025-26340.md): A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthen (CVSS 8.8, Q-Free MaxTime)
- [CVE-2025-26339](https://cve.now/CVE-2025-26339.md): A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 a (CVSS 9.8, Q-Free MaxTime)
- [CVE-2025-1102](https://cve.now/CVE-2025-1102.md): A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticat (CVSS 5.5, Q-Free MaxTime)
- [CVE-2025-1101](https://cve.now/CVE-2025-1101.md): A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticat (CVSS 5.3, Q-Free MaxTime)
- [CVE-2025-1100](https://cve.now/CVE-2025-1100.md): A CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated (CVSS 9.8, Q-Free MaxTime)
- [CVE-2025-1199](https://cve.now/CVE-2025-1199.md): SourceCodester Best Church Management Software role\_crud.php sql injection (CVSS 5.3, SourceCodester Best Church Management Software)
- [CVE-2025-1197](https://cve.now/CVE-2025-1197.md): code-projects Real Estate Property Management System load\_user-profile.php sql injection (CVSS 5.3, code-projects Real Estate Property Management System)
- [CVE-2024-10322](https://cve.now/CVE-2024-10322.md): Brizy – Page Builder \<= 2.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, themefusecom Brizy – Page Builder)
- [CVE-2025-1196](https://cve.now/CVE-2025-1196.md): code-projects Real Estate Property Management System search.php cross site scripting (CVSS 5.1, code-projects Real Estate Property Management System)
- [CVE-2025-1195](https://cve.now/CVE-2025-1195.md): code-projects Real Estate Property Management System EditCategory cross site scripting (CVSS 5.1, code-projects Real Estate Property Management System)
- [CVE-2024-12386](https://cve.now/CVE-2024-12386.md): WP Abstracts \<= 2.7.3 - Cross-Site Request Forgery to Arbitrary Account Deletion (CVSS 8.1, kevonadonis WP Abstracts)
- [CVE-2024-13480](https://cve.now/CVE-2024-13480.md): LTL Freight Quotes – For Customers of FedEx Freight \<= 3.4.1 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology LTL Freight Quotes – For Customers of Fed…)
- [CVE-2024-13532](https://cve.now/CVE-2024-13532.md): Small Package Quotes – Purolator Edition \<= 3.6.4 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology Small Package Quotes – Purolator Edition)
- [CVE-2024-13477](https://cve.now/CVE-2024-13477.md): LTL Freight Quotes – Unishippers Edition \<= 2.5.8 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology LTL Freight Quotes – Unishippers Edition)
- [CVE-2025-0511](https://cve.now/CVE-2025-0511.md): Welcart e-Commerce \<= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter (CVSS 7.2, uscnanbu Welcart e-Commerce)
- [CVE-2024-10960](https://cve.now/CVE-2024-10960.md): Brizy – Page Builder \<= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads (CVSS 9.9, themefusecom Brizy – Page Builder)
- [CVE-2025-1192](https://cve.now/CVE-2025-1192.md): SourceCodester Multi Restaurant Table Reservation System select-menu.php sql injection (CVSS 5.3, SourceCodester Multi Restaurant Table Reservation System)
- [CVE-2025-1230](https://cve.now/CVE-2025-1230.md): Cross-Site Scripting (XSS) vulnerability in Prestashop (CVSS 4.8, Prestashop)
- [CVE-2025-1191](https://cve.now/CVE-2025-1191.md): SourceCodester Multi Restaurant Table Reservation System approve-reject.php sql injection (CVSS 5.3, SourceCodester Multi Restaurant Table Reservation System)
- [CVE-2025-1190](https://cve.now/CVE-2025-1190.md): code-projects Job Recruitment load\_user-profile.php cross site scripting (CVSS 5.1, code-projects Job Recruitment)
- [CVE-2024-32838](https://cve.now/CVE-2024-32838.md): Apache Fineract: SQL injection vulnerabilities in offices API endpoint (CVSS 9.4, Apache Software Foundation Apache Fineract)
- [CVE-2025-1189](https://cve.now/CVE-2025-1189.md): 1000 Projects Attendance Tracking Management System chart1.php sql injection (CVSS 5.3, 1000 Projects Attendance Tracking Management System)
- [CVE-2024-12296](https://cve.now/CVE-2024-12296.md): Apus Framework \<= 2.4 - Authenticated (Subscriber+) Arbitrary Options Update in import\_page\_options (CVSS 8.8, ApusTheme Apus Framework)
- [CVE-2024-13531](https://cve.now/CVE-2024-13531.md): ShipEngine Shipping Quotes \<= 1.0.7 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology ShipEngine Shipping Quotes)
- [CVE-2024-13475](https://cve.now/CVE-2024-13475.md): Small Package Quotes – UPS Edition \<= 4.5.16 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology Small Package Quotes – UPS Edition)
- [CVE-2024-13437](https://cve.now/CVE-2024-13437.md): Book a Room \<= 2.9 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, chuhpl Book a Room)
- [CVE-2024-13459](https://cve.now/CVE-2024-13459.md): FuseDesk \<= 6.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, jeremyshapiro FuseDesk)
- [CVE-2024-13365](https://cve.now/CVE-2024-13365.md): Security & Malware scan by CleanTalk \<= 2.149 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Login Security, FireWall, Malware removal by CleanTalk)
- [CVE-2024-13490](https://cve.now/CVE-2024-13490.md): LTL Freight Quotes – XPO Edition \<= 4.3.7 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology LTL Freight Quotes – XPO Edition)
- [CVE-2024-12213](https://cve.now/CVE-2024-12213.md): WP Job Board Pro \< 1.2.85 - Unauthenticated Privilege Escalation via process\_register (CVSS 9.8, http://apusthemes.com/ WP Job Board Pro)
- [CVE-2024-13456](https://cve.now/CVE-2024-13456.md): Easy Quiz Maker \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, nmedia Easy Quiz Maker)
- [CVE-2024-13435](https://cve.now/CVE-2024-13435.md): Ebook Downloader \<= 1.0 - Unauthenticated SQL Injection (CVSS 7.5, iwcontribution Ebook Downloader)
- [CVE-2024-13473](https://cve.now/CVE-2024-13473.md): LTL Freight Quotes - Worldwide Express Edition \<= 5.0.20 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology LTL Freight Quotes – Worldwide Express Ed…)
- [CVE-2025-0506](https://cve.now/CVE-2025-0506.md): Rise Blocks – A Complete Gutenberg Page Builder \<= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleTag Parameter (CVSS 6.4, eaglethemes Rise Blocks – A Complete Gutenberg Page Builder)
- [CVE-2024-13528](https://cve.now/CVE-2024-13528.md): Customer Email Verification for WooCommerce \<= 2.9.5 - Authentication Bypass via Shortcode (CVSS 7.5, wpcodefactory Customer Email Verification for WooCommerce)
- [CVE-2025-1188](https://cve.now/CVE-2025-1188.md): Codezips Gym Management System updateroutine.php sql injection (CVSS 5.3, Codezips Gym Management System)
- [CVE-2025-1187](https://cve.now/CVE-2025-1187.md): code-projects Police FIR Record Management System Delete Record stack-based overflow (CVSS 4.8, code-projects Police FIR Record Management System)
- [CVE-2024-13814](https://cve.now/CVE-2024-13814.md): Global Gallery - WordPress Responsive Gallery \<= 9.1.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4, LCweb Global Gallery - WordPress Responsive Gallery)
- [CVE-2024-12315](https://cve.now/CVE-2024-12315.md): Export All Posts, Products, Orders, Refunds & Users \<= 2.9.3 - Information Disclosure Through Unprotected Directory (CVSS 7.5, smackcoders Export All Posts, Products, Orders, Refunds & U…)
- [CVE-2025-1186](https://cve.now/CVE-2025-1186.md): dayrui XunRuiCMS Api.php deserialization (CVSS 5.3, dayrui XunRuiCMS)
- [CVE-2023-49780](https://cve.now/CVE-2023-49780.md): Cross-site scripting vulnerability exists in acmailer CGI ver.4.0.5 and earlier. (CVSS 6.1, Extra Innovation acmailer CGI)
- [CVE-2024-13794](https://cve.now/CVE-2024-13794.md): Hide My WP Ghost – Security & Firewall \<= 5.3.02 - Unauthenticated Login Page Disclosure (CVSS 5.3, johndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall)
- [CVE-2024-13821](https://cve.now/CVE-2024-13821.md): WP Booking Calendar \<= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation (CVSS 5.3, wpdevelop Booking Calendar)
- [CVE-2025-1185](https://cve.now/CVE-2025-1185.md): pihome-shc PiHome ajax.php sql injection (CVSS 5.3, pihome-shc PiHome)
- [CVE-2025-1184](https://cve.now/CVE-2025-1184.md): pihome-shc PiHome ajax.php sql injection (CVSS 5.3, pihome-shc PiHome)
- [CVE-2025-1183](https://cve.now/CVE-2025-1183.md): CodeZips Gym Management System more-userprofile.php sql injection (CVSS 5.3, CodeZips Gym Management System)
- [CVE-2024-13601](https://cve.now/CVE-2024-13601.md): Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin \<= 1.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference (CVSS 4.3, ahmadmj Majestic Support – The Leading-Edge Help Desk & Cus…)
- [CVE-2024-13600](https://cve.now/CVE-2024-13600.md): Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin \<= 1.0.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 7.5, ahmadmj Majestic Support – The Leading-Edge Help Desk & Cus…)
- [CVE-2024-13714](https://cve.now/CVE-2024-13714.md): All-Images.ai – IA Image Bank and Custom Image creation \<= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, allimages All-Images.ai – IA Image Bank and Custom Image cr…)
- [CVE-2024-13374](https://cve.now/CVE-2024-13374.md): WP Table Manager \<= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure (CVSS 4.3, JoomUnited WP Table Manager)
- [CVE-2024-13654](https://cve.now/CVE-2024-13654.md): ZoxPress - The All-In-One WordPress News Theme \<= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion (CVSS 8.1, MVPThemes ZoxPress - The All-In-One WordPress News Theme)
- [CVE-2024-13656](https://cve.now/CVE-2024-13656.md): Click Mag - Viral WordPress News Magazine/Blog Theme \<= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion (CVSS 8.1, MVPThemes Click Mag - Viral WordPress News Magazine/Blog Th…)
- [CVE-2024-13658](https://cve.now/CVE-2024-13658.md): NGG Smart Image Search \<= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpo-hr NGG Smart Image Search)
- [CVE-2024-13665](https://cve.now/CVE-2024-13665.md): Admire Extra \<= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, sonalsinha21 Admire Extra)
- [CVE-2024-13653](https://cve.now/CVE-2024-13653.md): ZoxPress - The All-In-One WordPress News Theme \<= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, MVPThemes ZoxPress - The All-In-One WordPress News Theme)
- [CVE-2024-13421](https://cve.now/CVE-2024-13421.md): Real Estate 7 WordPress \<= 3.5.1 - Unauthenticated Privilege Escalation to Administrator (CVSS 9.8, contempoinc Real Estate 7 WordPress)
- [CVE-2024-12164](https://cve.now/CVE-2024-12164.md): WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon \<= 1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset (CVSS 4.3, creativewerkdesigns WPSyncSheets For WPForms – Google Sheet…)
- [CVE-2024-13800](https://cve.now/CVE-2024-13800.md): Popup Plugin For WordPress - ConvertPlus \<= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (CVSS 8.1, Brainstorm Force ConvertPlus)
- [CVE-2024-11746](https://cve.now/CVE-2024-11746.md): Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin \<= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, samdani GS Brands for WooCommerce)
- [CVE-2024-13769](https://cve.now/CVE-2024-13769.md): Puzzles | WP Magazine / Review with Store WordPress Theme + RTL \<= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, ThemeREX Puzzles | WP Magazine / Review with Store WordPres…)
- [CVE-2024-13541](https://cve.now/CVE-2024-13541.md): aDirectory – WordPress Directory Listing Plugin \<= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion (CVSS 4.3, aDirectory – WP Business Directory Plugin and Classified Ad…)
- [CVE-2024-13701](https://cve.now/CVE-2024-13701.md): Liveticker (by stklcode) \<= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Liveticker)
- [CVE-2024-13749](https://cve.now/CVE-2024-13749.md): StaffList \<= 3.2.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1, era404 StaffList)
- [CVE-2025-0808](https://cve.now/CVE-2025-0808.md): Houzez Property Feed \<= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion (CVSS 4.3, propertyhive Houzez Property Feed)
- [CVE-2024-13539](https://cve.now/CVE-2024-13539.md): AForms Eats \<= 1.3.1 - Unauthenticated Full Path Disclosure (CVSS 5.3, vividcolorsjp AForms Eats)
- [CVE-2024-13554](https://cve.now/CVE-2024-13554.md): The Ultimate WordPress Toolkit – WP Extended \<= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation (CVSS 5.3, wpextended The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2024-29172](https://cve.now/CVE-2024-29172.md): Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains a deadlock vulnerability. (CVSS 5.9, Dell BSAFE SSL-J)
- [CVE-2024-29171](https://cve.now/CVE-2024-29171.md): Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains an Improper certificate verification vulnerability. (CVSS 5.9, Dell BSAFE SSL-J)
- [CVE-2025-23359](https://cve.now/CVE-2025-23359.md): NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a (CVSS 8.3, NVIDIA Container Toolkit · NVIDIA GPU Operator)
- [CVE-2024-53880](https://cve.now/CVE-2024-53880.md): NVIDIA Triton Inference Server contains a vulnerability in the model loading API, where a user could cause an integer overflow or wraparound (CVSS 4.9, NVIDIA Triton Inference Server)
- [CVE-2024-0145](https://cve.now/CVE-2024-0145.md): NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a heap-based buffer overflow issue by means of a specially cr (CVSS 6.8, NVIDIA nvJPEG2000)
- [CVE-2024-0144](https://cve.now/CVE-2024-0144.md): NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a buffer overflow issue by means of a specially crafted JPEG2 (CVSS 6.8, NVIDIA nvJPEG2000)
- [CVE-2024-0143](https://cve.now/CVE-2024-0143.md): NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause an out-of-bounds write issue by means of a specially crafted (CVSS 6.8, NVIDIA nvJPEG2000)
- [CVE-2025-1243](https://cve.now/CVE-2025-1243.md): Field in api-go proxy not transformed before version 1.44.1 (CVSS 2.0, Temporal Technologies api-go library · go.temporal.io/api)
- [CVE-2024-0142](https://cve.now/CVE-2024-0142.md): NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause an out-of-bounds write issue by means of a specially crafted (CVSS 6.8, NVIDIA nvJPEG2000)
- [CVE-2024-21971](https://cve.now/CVE-2024-21971.md): Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, r (CVSS 5.5, AMD Ryzen™ 5000 Series Desktop Processors · AMD Ryzen™… +25)
- [CVE-2024-34520](https://cve.now/CVE-2024-34520.md): An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R\_1\_0\_24\_0, which allows (CVSS 8.8)
- [CVE-2024-34521](https://cve.now/CVE-2024-34521.md): A directory traversal vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R\_1\_0\_24\_0, which allows a (CVSS 3.5)
- [CVE-2024-46922](https://cve.now/CVE-2024-46922.md): An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. (CVSS 7.5)
- [CVE-2024-46923](https://cve.now/CVE-2024-46923.md): An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. (CVSS 7.5)
- [CVE-2024-51122](https://cve.now/CVE-2024-51122.md): Cross Site Scripting vulnerability in Zertificon Z1 SecureMail Z1 CertServer v.3.16.4-2516-debian12 alllows a remote attacker to execute arb (CVSS 6.1)
- [CVE-2024-51123](https://cve.now/CVE-2024-51123.md): An issue in Zertificon Z1 SecureMail Z1 SecureMail Gateway 4.44.2-7240-debian12 allows a remote attacker to obtain sensitive information via (CVSS 7.5)
- [CVE-2024-51376](https://cve.now/CVE-2024-51376.md): Directory Traversal vulnerability in yeqifu carRental v.1.0 allows a remote attacker to obtain sensitive information via the file/downloadFi (CVSS 7.5)
- [CVE-2024-51440](https://cve.now/CVE-2024-51440.md): An issue in Nothing Tech Nothing OS v.2.6 allows a local attacker to escalate privileges via the NtBpfService component. (CVSS 7.8)
- [CVE-2024-54160](https://cve.now/CVE-2024-54160.md): dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because Markdown is not sani (CVSS 6.4, LF Projects OpenSearch)
- [CVE-2024-56938](https://cve.now/CVE-2024-56938.md): LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class. (CVSS 5.4)
- [CVE-2024-56939](https://cve.now/CVE-2024-56939.md): LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body class. (CVSS 5.4)
- [CVE-2024-56940](https://cve.now/CVE-2024-56940.md): An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service (DoS) via excessive file upl (CVSS 7.5)
- [CVE-2024-57601](https://cve.now/CVE-2024-57601.md): Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the le (CVSS 6.1, alextselegidis/easyappointments)
- [CVE-2024-57602](https://cve.now/CVE-2024-57602.md): An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file. (CVSS 9.8, alextselegidis/easyappointments)
- [CVE-2024-57603](https://cve.now/CVE-2024-57603.md): An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting. (CVSS 6.3, github.com/mayswind/ezbookkeeping)
- [CVE-2024-57604](https://cve.now/CVE-2024-57604.md): An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component. (CVSS 9.8, github.com/mayswind/ezbookkeeping)
- [CVE-2024-57605](https://cve.now/CVE-2024-57605.md): Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and / (CVSS 5.4)
- [CVE-2025-25343](https://cve.now/CVE-2025-25343.md): Tenda AC6 V15.03.05.16 firmware has a buffer overflow vulnerability in the formexeCommand function. (CVSS 9.8)
- [CVE-2025-25349](https://cve.now/CVE-2025-25349.md): PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the costitem parameter. (CVSS 9.8)
- [CVE-2025-25351](https://cve.now/CVE-2025-25351.md): PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the dateexpense parameter. (CVSS 9.8)
- [CVE-2025-25741](https://cve.now/CVE-2025-25741.md): D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the IPv6\_PppoePassword parameter in th (CVSS 5.4)
- [CVE-2025-25742](https://cve.now/CVE-2025-25742.md): D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the AccountPassword parameter in the S (CVSS 9.8)
- [CVE-2025-25743](https://cve.now/CVE-2025-25743.md): D-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module. (CVSS 7.2)
- [CVE-2025-25744](https://cve.now/CVE-2025-25744.md): D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynam (CVSS 9.8)
- [CVE-2025-25746](https://cve.now/CVE-2025-25746.md): D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetWanSe (CVSS 9.8)
- [CVE-2025-26520](https://cve.now/CVE-2025-26520.md): Cacti through 1.2.29 allows SQL injection in the template function in host\_templates.php via the graph\_template parameter. (CVSS 7.6, Cacti)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.