CVEs published February 13, 2025
132 CVEs were published on February 13, 2025: 13 critical, 66 high.
- Published
- 132
- Critical
- 13
- High
- 66
- Medium
- 46
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- GitLab
- 4
- mySCADA myPRO Manager
- 4
- Schneider Electric ASCO 5310 Single-Channel Remote Annuncia…
- 4
- Outback Power Mojave Inverter
- 3
- Paid Membership Plugin, Ecommerce, User Registration Form,…
- 3
- Schneider Electric Enerlin’X IFE interface · Schneider Elec…
- 3
- Synology Active Backup for Business
- 3
- Zettler
- 3
- Anapi Group H6Web
- 2
- DethemeKit for Elementor
- 2
Critical 13
- CVE-2025-25067mySCADA myPRO Manager OS Command InjectionmySCADA myPRO Manager
- CVE-2025-24865mySCADA myPRO Manager Missing Authentication for Critical FunctionmySCADA myPRO Manager
- CVE-2025-1283Dingtian DT-R0 Series Authentication Bypass Using an Alternate Path or ChannelDingtian DT-R002 · Dingtian DT-R008 +2
- CVE-2025-1127Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web serverLexmark CX, XC, CS, MS, MX, XM, et. al.
- CVE-2025-1270Insecure direct object reference (IDOR) vulnerability in H6WebAnapi Group H6Web
- CVE-2024-13182WP Directorybox Manager <= 2.5 - Authentication BypassChimpstudio WP Directorybox Manager
- CVE-2024-10763Campress <= 1.35 - Unauthenticated Local File InclusionApusTheme Campress
- CVE-2025-0896Orthanc Server Missing Authentication for Critical FunctionOrthanc server
- CVE-2024-7102Execution with Unnecessary Privileges in GitLabGitLab
- CVE-2025-25286Crayfish allows Remote Code Execution via Homarus Authorization headerIslandora Crayfish · islandora/crayfish
- CVE-2023-34399Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.
- CVE-2025-25388A SQL Injection vulnerability was found in /admin/edit-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers
- CVE-2025-25389A SQL Injection vulnerability was found in /admin/forgot-password.php in Phpgurukul Land Record System v1.0, which allows remote attackers t
High 66
- CVE-2025-24836Qardio Heart Health IOS and Android Application and QardioARM A100 Uncaught ExceptionQardio Heart Health IOS Mobile Application · Qardio Hear… +1
- CVE-2025-22896mySCADA myPRO Manager Cleartext Storage of Sensitive InformationmySCADA myPRO Manager
- CVE-2025-24861Outback Power Mojave Inverter Command InjectionOutback Power Mojave Inverter
- CVE-2025-25281Outback Power Mojave Inverter Exposure of Sensitive Information to an Unauthorized ActorOutback Power Mojave Inverter
- CVE-2025-26473Outback Power Mojave Inverter Use of GET Request Method With Sensitive Query StringsOutback Power Mojave Inverter
- CVE-2024-11347Access of Resource Using Incompatible Type in Postscript interpreterLexmark International CX, XC, CS, et. al.
- CVE-2024-11346Access of Resource Using Incompatible Type in Postscript interpreterLexmark International CX, XC, CS, MS, MX, XM, et. al.
- CVE-2024-11344Type confusion vulnerability in the Postscript interpreter in various Lexmark devicesLexmark CX, XC, CS, MS, MX, XM, et. al.
- CVE-2024-11345Heap-based memory vulnerability in the Postscript interpreter in various Lexmark devicesLexmark International CX, XC, CS, MS, MX, XM, et. al.
- CVE-2025-24888Path traversal in SecureDrop Client API.download_reply()freedomofpress securedrop-client
- CVE-2025-22480Dell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability.Dell SupportAssist OS Recovery
- CVE-2024-12013A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h.Zettler
- CVE-2024-12011A CWE-126 “Buffer Over-read” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h.Zettler
- CVE-2025-26511Cassandra-Lucene-Index allows bypass of Cassandra RBACNetApp Instaclustr fork of Stratio's Cassandra-Lucene-Index…
- CVE-2025-24904libsignal-service-rs doesn't sanity check plaintext envelopes are not sanity-checkedwhisperfish libsignal-service-rs
- CVE-2025-24903libsignal-service-rs Doesn't Check Origin of Sync Messageswhisperfish libsignal-service-rs
- CVE-2025-21701net: avoid race between device unregistration and ethnl opsLinux · :linux_kernel:
- CVE-2025-26582WordPress TinyMCE Advanced qTranslate fix editor problems plugin <= 1.0.0 - CSRF to Stored XSS vulnerabilityBlackbam TinyMCE Advanced qTranslate fix editor problems
- CVE-2025-26580WordPress Page/Post Specific Social Share Buttons plugin <= 2.1 - CSRF to Stored XSS vulnerabilityComplete SEO Page/Post Specific Social Share Buttons
- CVE-2025-26578WordPress Simple Documentation plugin <= 1.2.8 - CSRF to Stored XSS vulnerabilitymathieuhays Simple Documentation
- CVE-2025-26577WordPress DX-auto-publish plugin <= 1.2 - CSRF to Stored XSS vulnerabilitydaxiawp DX-auto-publish
- CVE-2025-26572WordPress WP PHPList Plugin <= 1.7 - CSRF to Stored XSS vulnerabilityjesseheap WP PHPList
- CVE-2025-26571WordPress Wibiya Toolbar plugin <= 2.0 - CSRF to Stored XSS vulnerabilityWibiya Toolbar
- CVE-2025-26570WordPress Glance That plugin <= 4.9 - CSRF to Stored XSS vulnerabilityuamv Glance That
- CVE-2025-26569WordPress Post Thumbs Plugin <= 1.5 - CSRF to Stored XSS vulnerabilityCallmeforsox Post Thumbs
- CVE-2025-26568WordPress Easy Amazon Product Information plugin <= 4.0.1 - CSRF to Stored XSS vulnerabilityjensmueller Easy Amazon Product Information
- CVE-2025-26562WordPress RSS FIlter Plugin <= 1.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityShambhu Patnaik RSS Filter
- CVE-2025-26552WordPress Naver Syndication V2 plugin <= 0.8.3 - CSRF to Stored Cross-Site Scripting vulnerabilitybadrHan Naver Syndication
- CVE-2025-26551WordPress Bootstrap collapse plugin <= 1.0.4 - CSRF to Stored Cross-Site Scripting vulnerabilitysureshdsk Bootstrap collapse
- CVE-2025-26550WordPress Global Meta Keyword & Description plugin <= 2.3 - CSRF to Cross-Site Scripting vulnerabilityKunal Shivale Global Meta Keyword & Description
- CVE-2025-26549WordPress WP Html Page Sitemap plugin <= 2.2 - CSRF to Stored Cross-Site Scriptingpa1 WP Html Page Sitemap
- CVE-2025-26547WordPress My Login Logout Plugin plugin <= 2.4 - CSRF to Stored Cross-Site Scripting vulnerabilitynagarjunsonti My Login Logout Plugin
- CVE-2025-26545WordPress Related Posts Line-up-Exactly by Milliard plugin <= 0.0.22 - CSRF to Stored XSS vulnerabilityshisuh Related Posts Line-up-Exactly by Milliard
- CVE-2025-26543WordPress Simple Responsive Menu plugin <= 2.1 - CSRF to Stored XSS vulnerabilityPukhraj Suthar Simple Responsive Menu
- CVE-2025-1247Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instancequarkus-rest · Red Hat Build of Apache Camel 4.8 for Qua… +4
- CVE-2025-1094PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validationPostgreSQL
- CVE-2025-21700net: sched: Disallow replacing of child qdisc from one parent to anotherLinux
- CVE-2024-13606JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Unauthenticated Sensitive Information Exposure Through Unprotected Directoryrabilal JS Help Desk – AI-Powered Support & Ticketing System
- CVE-2024-46910Apache Atlas: An authenticated user can perform XSS and potentially impersonate another userApache Software Foundation Apache Atlas · org.apache.atlas:…
- CVE-2024-13345Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Executionthemefusion Avada (Fusion) Builder
- CVE-2024-13346Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode ExecutionThemeFusion Avada | Website Builder For WordPress & WooComm…
- CVE-2025-0815CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious ICMPV6 packets are sSchneider Electric Enerlin’X IFE interface · Schneider Elec…
- CVE-2025-0816CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are senSchneider Electric Enerlin’X IFE interface · Schneider Elec…
- CVE-2025-0327CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting asSchneider Electric EcoStruxure Process Expert
- CVE-2025-1070CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file Schneider Electric ASCO 5310 Single-Channel Remote Annuncia…
- CVE-2025-1060CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network trafficSchneider Electric ASCO 5310 Single-Channel Remote Annuncia…
- CVE-2025-1059CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious paSchneider Electric ASCO 5310 Single-Channel Remote Annuncia…
- CVE-2025-1058CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is doSchneider Electric ASCO 5310 Single-Channel Remote Annuncia…
- CVE-2024-13770Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Unauthenticated PHP Object InjectionThemeREX Puzzles | WP Magazine / Review with Store WordPres…
- CVE-2023-34397Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB.
- CVE-2023-34398Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.
- CVE-2023-34400Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.
- CVE-2023-34402Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.
- CVE-2024-57378Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability.
- CVE-2025-22960A session hijacking vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters.
- CVE-2025-22961A critical information disclosure vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters due
- CVE-2025-22962A critical remote code execution (RCE) vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters
- CVE-2025-25352A SQL Injection vulnerability was found in /admin/aboutus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execut
- CVE-2025-25354A SQL Injection was found in /admin/admin-profile.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitr
- CVE-2025-25355A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote att
- CVE-2025-25356A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote att
- CVE-2025-25357A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to exec
- CVE-2025-25387A SQL Injection vulnerability was found in /admin/manage-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attacke
- CVE-2025-25897A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'ip' parameter at /userRpm/WanStaticIpV6CfgRpm.htm.
- CVE-2025-25898A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm.
- CVE-2025-25901A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/
Medium, low and unrated 53
- CVE-2024-12054ZF Roll Stability Support Plus (RSSPlus) Authentication Bypass By Primary WeaknessZF RSSPlus
- CVE-2025-23421Qardio iOS and Android applications Files or Directories Accessible to External PartiesQardio Heart Health IOS Mobile Application · Qardio Heart H…
- CVE-2025-25195Zulip events can leak private channel nameszulip
- CVE-2025-20615Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized ActorQardio Heart Health IOS Mobile Application
- CVE-2025-23411mySCADA myPRO Manager Cross-Site Request ForgerymySCADA myPRO Manager
- CVE-2025-24889Path traversal in sd-log Qubes virtual machinefreedomofpress securedrop-client
- CVE-2024-12012A CWE-598 “Use of GET Request Method with Sensitive Query Strings” was discovered affecting the 130.8005 TCP/IP Gateway running firmware verZettler
- CVE-2025-25287Lakeus vulnerable to stored XSS via system messageslakejason0 mediawiki-skins-Lakeus
- CVE-2025-0426A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet readKubernetes kubelet · k8s.io/kubernetes
- CVE-2025-26539WordPress Embed Google Map plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilitypetkivim Embed Google Map
- CVE-2025-26538WordPress Prezi Embedder plugin <= 2.1 - Stored Cross Site Scripting (XSS) vulnerabilityDan Rossiter Prezi Embedder
- CVE-2025-26574WordPress Google Drive WP Media plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerabilityMoch Amir Google Drive WP Media
- CVE-2025-26567WordPress Font Awesome WP plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityfarjana55 Font Awesome WP
- CVE-2025-26561WordPress Elfsight Yottie Lite Plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityElfsight Yottie Lite
- CVE-2025-26558WordPress Aparat Responsive plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilitymkkmail Aparat Responsive
- CVE-2025-1271Reflected Cross-Site Scripting (XSS) vulnerability in H6WebAnapi Group H6Web
- CVE-2024-13867Listivo - Classified Ads WordPress Theme <= 2.3.67 - Reflected Cross-Site ScriptingTangibleWP Listivo - Classified Ads WordPress Theme
- CVE-2024-3303Improper Neutralization of Input Used for LLM Prompting in GitLabGitLab
- CVE-2024-13639Read More & Accordion <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post Deletionedmonparker Read More & Accordion
- CVE-2025-0661DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Protected Post DisclosureDethemeKit for Elementor
- CVE-2025-0814CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the network services running on the product wheSchneider Electric Enerlin’X IFE interface · Schneider Elec…
- CVE-2024-47266Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology AcSynology Active Backup for Business
- CVE-2024-47265Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in SynoSynology Active Backup for Business
- CVE-2024-47264Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in agent-related functionality in Synology ActiSynology Active Backup for Business
- CVE-2025-0692Simple Video Management System <= 1.0.4 - Admin+ Stored XSSSimple Video Management System
- CVE-2024-13125Everest Forms < 3.0.8.1 - Admin+ Stored XSSEverest Forms
- CVE-2024-13121Paid Membership Plugin < 4.15.20 - Admin+ Stored XSSPaid Membership Plugin, Ecommerce, User Registration Form,…
- CVE-2024-13120ProfilePress < 4.15.20 - Admin+ Stored XSSPaid Membership Plugin, Ecommerce, User Registration Form,…
- CVE-2024-13119ProfilePress < 4.15.20 - Admin+ Stored XSSPaid Membership Plugin, Ecommerce, User Registration Form,…
- CVE-2024-12586Chalet Montagne Com Tools <= 2.7.8 - Reflected XSSChalet-Montagne.com Tools
- CVE-2024-10083CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of engineering workstation when specific driver inSchneider Electric Uni-Telway driver
- CVE-2025-0837Puzzles <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeThemeREX Puzzles | WP Magazine / Review with Store WordPres…
- CVE-2024-13229Rank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletionrankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…
- CVE-2024-13227Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math APIrankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…
- CVE-2024-13644DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery WidgetDethemeKit for Elementor
- CVE-2025-1198Insufficient Session Expiration in GitLabGitLab
- CVE-2024-8266Execution with Unnecessary Privileges in GitLabGitLab
- CVE-2023-34401Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.
- CVE-2023-34403Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB.
- CVE-2023-34404Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB.
- CVE-2023-34406An issue was discovered on Mercedes Benz NTG 6.
- CVE-2024-37600An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021.
- CVE-2024-37601An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6.
- CVE-2024-37602An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021.
- CVE-2024-37603An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6.
- CVE-2024-53309A stack-based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when an overly long string
- CVE-2024-53310A Structured Exception Handler based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 whe
- CVE-2024-53311A Stack buffer overflow in the arguments parameter in Immunity Inc.
- CVE-2024-54951Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS).
- CVE-2024-56908In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint.
- CVE-2024-57782An issue in Docker-proxy v18.09.0 allows attackers to cause a denial of service.
- CVE-2025-25899A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'gw' parameter at /userRpm/WanDynamicIpV6CfgRpm.htm.
- CVE-2025-25900A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the username and password parameters at /userRpm/PPPoEv6CfgRpm.