# CVEs published 2025-02-13

132 CVEs were published on February 13, 2025: 13 critical, 66 high. Days are UTC.

- [CVE-2024-12054](https://cve.now/CVE-2024-12054.md): ZF Roll Stability Support Plus (RSSPlus) Authentication Bypass By Primary Weakness (CVSS 5.4, ZF RSSPlus)
- [CVE-2025-24836](https://cve.now/CVE-2025-24836.md): Qardio Heart Health IOS and Android Application and QardioARM A100 Uncaught Exception (CVSS 7.1, Qardio Heart Health IOS Mobile Application · Qardio Hear… +1)
- [CVE-2025-23421](https://cve.now/CVE-2025-23421.md): Qardio iOS and Android applications Files or Directories Accessible to External Parties (CVSS 6.4, Qardio Heart Health IOS Mobile Application · Qardio Heart H…)
- [CVE-2025-25195](https://cve.now/CVE-2025-25195.md): Zulip events can leak private channel names (CVSS 4.3, zulip)
- [CVE-2025-20615](https://cve.now/CVE-2025-20615.md): Qardio Heart Health IOS Mobile Application Exposure of Private Personal Information to an Unauthorized Actor (CVSS 6.2, Qardio Heart Health IOS Mobile Application)
- [CVE-2025-25067](https://cve.now/CVE-2025-25067.md): mySCADA myPRO Manager OS Command Injection (CVSS 9.8, mySCADA myPRO Manager)
- [CVE-2025-23411](https://cve.now/CVE-2025-23411.md): mySCADA myPRO Manager Cross-Site Request Forgery (CVSS 6.3, mySCADA myPRO Manager)
- [CVE-2025-22896](https://cve.now/CVE-2025-22896.md): mySCADA myPRO Manager Cleartext Storage of Sensitive Information (CVSS 8.6, mySCADA myPRO Manager)
- [CVE-2025-24865](https://cve.now/CVE-2025-24865.md): mySCADA myPRO Manager Missing Authentication for Critical Function (CVSS 10.0, mySCADA myPRO Manager)
- [CVE-2025-24861](https://cve.now/CVE-2025-24861.md): Outback Power Mojave Inverter Command Injection (CVSS 7.5, Outback Power Mojave Inverter)
- [CVE-2025-25281](https://cve.now/CVE-2025-25281.md): Outback Power Mojave Inverter Exposure of Sensitive Information to an Unauthorized Actor (CVSS 7.5, Outback Power Mojave Inverter)
- [CVE-2025-26473](https://cve.now/CVE-2025-26473.md): Outback Power Mojave Inverter Use of GET Request Method With Sensitive Query Strings (CVSS 7.5, Outback Power Mojave Inverter)
- [CVE-2025-1283](https://cve.now/CVE-2025-1283.md): Dingtian DT-R0 Series Authentication Bypass Using an Alternate Path or Channel (CVSS 9.8, Dingtian DT-R002 · Dingtian DT-R008 +2)
- [CVE-2024-11347](https://cve.now/CVE-2024-11347.md): Access of Resource Using Incompatible Type in Postscript interpreter (CVSS 7.3, Lexmark International CX, XC, CS, et. al.)
- [CVE-2024-11346](https://cve.now/CVE-2024-11346.md): Access of Resource Using Incompatible Type in Postscript interpreter (CVSS 7.3, Lexmark International CX, XC, CS, MS, MX, XM, et. al.)
- [CVE-2024-11344](https://cve.now/CVE-2024-11344.md): Type confusion vulnerability in the Postscript interpreter in various Lexmark devices (CVSS 7.3, Lexmark CX, XC, CS, MS, MX, XM, et. al.)
- [CVE-2025-1127](https://cve.now/CVE-2025-1127.md): Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server (CVSS 9.1, Lexmark CX, XC, CS, MS, MX, XM, et. al.)
- [CVE-2024-11345](https://cve.now/CVE-2024-11345.md): Heap-based memory vulnerability in the Postscript interpreter in various Lexmark devices (CVSS 7.3, Lexmark International CX, XC, CS, MS, MX, XM, et. al.)
- [CVE-2025-24889](https://cve.now/CVE-2025-24889.md): Path traversal in sd-log Qubes virtual machine (CVSS 4.5, freedomofpress securedrop-client)
- [CVE-2025-24888](https://cve.now/CVE-2025-24888.md): Path traversal in SecureDrop Client API.download\_reply() (CVSS 8.1, freedomofpress securedrop-client)
- [CVE-2025-22480](https://cve.now/CVE-2025-22480.md): Dell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability. (CVSS 7.0, Dell SupportAssist OS Recovery)
- [CVE-2024-12013](https://cve.now/CVE-2024-12013.md): A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. (CVSS 7.6, Zettler)
- [CVE-2024-12012](https://cve.now/CVE-2024-12012.md): A CWE-598 “Use of GET Request Method with Sensitive Query Strings” was discovered affecting the 130.8005 TCP/IP Gateway running firmware ver (CVSS 5.7, Zettler)
- [CVE-2024-12011](https://cve.now/CVE-2024-12011.md): A CWE-126 “Buffer Over-read” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. (CVSS 7.6, Zettler)
- [CVE-2025-26511](https://cve.now/CVE-2025-26511.md): Cassandra-Lucene-Index allows bypass of Cassandra RBAC (CVSS 8.8, NetApp Instaclustr fork of Stratio's Cassandra-Lucene-Index…)
- [CVE-2025-25287](https://cve.now/CVE-2025-25287.md): Lakeus vulnerable to stored XSS via system messages (CVSS 4.7, lakejason0 mediawiki-skins-Lakeus)
- [CVE-2025-24904](https://cve.now/CVE-2025-24904.md): libsignal-service-rs doesn't sanity check plaintext envelopes are not sanity-checked (CVSS 8.5, whisperfish libsignal-service-rs)
- [CVE-2025-24903](https://cve.now/CVE-2025-24903.md): libsignal-service-rs Doesn't Check Origin of Sync Messages (CVSS 8.5, whisperfish libsignal-service-rs)
- [CVE-2025-0426](https://cve.now/CVE-2025-0426.md): A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read (CVSS 6.2, Kubernetes kubelet · k8s.io/kubernetes)
- [CVE-2025-21701](https://cve.now/CVE-2025-21701.md): net: avoid race between device unregistration and ethnl ops (CVSS 7.8, Linux · :linux\_kernel:)
- [CVE-2025-26539](https://cve.now/CVE-2025-26539.md): WordPress Embed Google Map plugin \<= 3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, petkivim Embed Google Map)
- [CVE-2025-26538](https://cve.now/CVE-2025-26538.md): WordPress Prezi Embedder plugin \<= 2.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Dan Rossiter Prezi Embedder)
- [CVE-2025-26582](https://cve.now/CVE-2025-26582.md): WordPress TinyMCE Advanced qTranslate fix editor problems plugin \<= 1.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Blackbam TinyMCE Advanced qTranslate fix editor problems)
- [CVE-2025-26580](https://cve.now/CVE-2025-26580.md): WordPress Page/Post Specific Social Share Buttons plugin \<= 2.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Complete SEO Page/Post Specific Social Share Buttons)
- [CVE-2025-26578](https://cve.now/CVE-2025-26578.md): WordPress Simple Documentation plugin \<= 1.2.8 - CSRF to Stored XSS vulnerability (CVSS 7.1, mathieuhays Simple Documentation)
- [CVE-2025-26577](https://cve.now/CVE-2025-26577.md): WordPress DX-auto-publish plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, daxiawp DX-auto-publish)
- [CVE-2025-26574](https://cve.now/CVE-2025-26574.md): WordPress Google Drive WP Media plugin \<= 2.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Moch Amir Google Drive WP Media)
- [CVE-2025-26572](https://cve.now/CVE-2025-26572.md): WordPress WP PHPList Plugin \<= 1.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, jesseheap WP PHPList)
- [CVE-2025-26571](https://cve.now/CVE-2025-26571.md): WordPress Wibiya Toolbar plugin \<= 2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Wibiya Toolbar)
- [CVE-2025-26570](https://cve.now/CVE-2025-26570.md): WordPress Glance That plugin \<= 4.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, uamv Glance That)
- [CVE-2025-26569](https://cve.now/CVE-2025-26569.md): WordPress Post Thumbs Plugin \<= 1.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Callmeforsox Post Thumbs)
- [CVE-2025-26568](https://cve.now/CVE-2025-26568.md): WordPress Easy Amazon Product Information plugin \<= 4.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, jensmueller Easy Amazon Product Information)
- [CVE-2025-26567](https://cve.now/CVE-2025-26567.md): WordPress Font Awesome WP plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, farjana55 Font Awesome WP)
- [CVE-2025-26562](https://cve.now/CVE-2025-26562.md): WordPress RSS FIlter Plugin \<= 1.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Shambhu Patnaik RSS Filter)
- [CVE-2025-26561](https://cve.now/CVE-2025-26561.md): WordPress Elfsight Yottie Lite Plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Elfsight Yottie Lite)
- [CVE-2025-26558](https://cve.now/CVE-2025-26558.md): WordPress Aparat Responsive plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mkkmail Aparat Responsive)
- [CVE-2025-26552](https://cve.now/CVE-2025-26552.md): WordPress Naver Syndication V2 plugin \<= 0.8.3 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, badrHan Naver Syndication)
- [CVE-2025-26551](https://cve.now/CVE-2025-26551.md): WordPress Bootstrap collapse plugin \<= 1.0.4 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, sureshdsk Bootstrap collapse)
- [CVE-2025-26550](https://cve.now/CVE-2025-26550.md): WordPress Global Meta Keyword & Description plugin \<= 2.3 - CSRF to Cross-Site Scripting vulnerability (CVSS 7.1, Kunal Shivale Global Meta Keyword & Description)
- [CVE-2025-26549](https://cve.now/CVE-2025-26549.md): WordPress WP Html Page Sitemap plugin \<= 2.2 - CSRF to Stored Cross-Site Scripting (CVSS 7.1, pa1 WP Html Page Sitemap)
- [CVE-2025-26547](https://cve.now/CVE-2025-26547.md): WordPress My Login Logout Plugin plugin \<= 2.4 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, nagarjunsonti My Login Logout Plugin)
- [CVE-2025-26545](https://cve.now/CVE-2025-26545.md): WordPress Related Posts Line-up-Exactly by Milliard plugin \<= 0.0.22 - CSRF to Stored XSS vulnerability (CVSS 7.1, shisuh Related Posts Line-up-Exactly by Milliard)
- [CVE-2025-26543](https://cve.now/CVE-2025-26543.md): WordPress Simple Responsive Menu plugin \<= 2.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Pukhraj Suthar Simple Responsive Menu)
- [CVE-2025-1247](https://cve.now/CVE-2025-1247.md): Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance (CVSS 8.3, quarkus-rest · Red Hat Build of Apache Camel 4.8 for Qua… +4)
- [CVE-2025-1094](https://cve.now/CVE-2025-1094.md): PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation (CVSS 8.1, PostgreSQL)
- [CVE-2025-1271](https://cve.now/CVE-2025-1271.md): Reflected Cross-Site Scripting (XSS) vulnerability in H6Web (CVSS 6.1, Anapi Group H6Web)
- [CVE-2025-1270](https://cve.now/CVE-2025-1270.md): Insecure direct object reference (IDOR) vulnerability in H6Web (CVSS 9.1, Anapi Group H6Web)
- [CVE-2024-13182](https://cve.now/CVE-2024-13182.md): WP Directorybox Manager \<= 2.5 - Authentication Bypass (CVSS 9.8, Chimpstudio WP Directorybox Manager)
- [CVE-2025-21700](https://cve.now/CVE-2025-21700.md): net: sched: Disallow replacing of child qdisc from one parent to another (CVSS 7.8, Linux)
- [CVE-2024-13606](https://cve.now/CVE-2024-13606.md): JS Help Desk – The Ultimate Help Desk & Support Plugin \<= 2.8.8 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 7.5, rabilal JS Help Desk – AI-Powered Support & Ticketing System)
- [CVE-2024-13867](https://cve.now/CVE-2024-13867.md): Listivo - Classified Ads WordPress Theme \<= 2.3.67 - Reflected Cross-Site Scripting (CVSS 6.1, TangibleWP Listivo - Classified Ads WordPress Theme)
- [CVE-2024-46910](https://cve.now/CVE-2024-46910.md): Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user (CVSS 7.1, Apache Software Foundation Apache Atlas · org.apache.atlas:…)
- [CVE-2024-3303](https://cve.now/CVE-2024-3303.md): Improper Neutralization of Input Used for LLM Prompting in GitLab (CVSS 6.4, GitLab)
- [CVE-2024-13639](https://cve.now/CVE-2024-13639.md): Read More & Accordion \<= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post Deletion (CVSS 4.3, edmonparker Read More & Accordion)
- [CVE-2024-13345](https://cve.now/CVE-2024-13345.md): Avada Builder \<= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, themefusion Avada (Fusion) Builder)
- [CVE-2024-13346](https://cve.now/CVE-2024-13346.md): Avada Theme \<= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, ThemeFusion Avada | Website Builder For WordPress & WooComm…)
- [CVE-2025-0661](https://cve.now/CVE-2025-0661.md): DethemeKit For Elementor \<= 2.1.8 - Authenticated (Contributor+) Protected Post Disclosure (CVSS 4.3, DethemeKit for Elementor)
- [CVE-2025-0814](https://cve.now/CVE-2025-0814.md): CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the network services running on the product whe (CVSS 6.9, Schneider Electric Enerlin’X IFE interface · Schneider Elec…)
- [CVE-2025-0815](https://cve.now/CVE-2025-0815.md): CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious ICMPV6 packets are s (CVSS 7.1, Schneider Electric Enerlin’X IFE interface · Schneider Elec…)
- [CVE-2025-0816](https://cve.now/CVE-2025-0816.md): CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are sen (CVSS 7.1, Schneider Electric Enerlin’X IFE interface · Schneider Elec…)
- [CVE-2024-47266](https://cve.now/CVE-2024-47266.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology Ac (CVSS 2.7, Synology Active Backup for Business)
- [CVE-2024-47265](https://cve.now/CVE-2024-47265.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Syno (CVSS 6.5, Synology Active Backup for Business)
- [CVE-2024-47264](https://cve.now/CVE-2024-47264.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in agent-related functionality in Synology Acti (CVSS 4.9, Synology Active Backup for Business)
- [CVE-2025-0327](https://cve.now/CVE-2025-0327.md): CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as (CVSS 8.5, Schneider Electric EcoStruxure Process Expert)
- [CVE-2025-0692](https://cve.now/CVE-2025-0692.md): Simple Video Management System \<= 1.0.4 - Admin+ Stored XSS (CVSS 3.5, Simple Video Management System)
- [CVE-2024-13125](https://cve.now/CVE-2024-13125.md): Everest Forms \< 3.0.8.1 - Admin+ Stored XSS (CVSS 3.5, Everest Forms)
- [CVE-2024-13121](https://cve.now/CVE-2024-13121.md): Paid Membership Plugin \< 4.15.20 - Admin+ Stored XSS (CVSS 3.5, Paid Membership Plugin, Ecommerce, User Registration Form,…)
- [CVE-2024-13120](https://cve.now/CVE-2024-13120.md): ProfilePress \< 4.15.20 - Admin+ Stored XSS (CVSS 4.8, Paid Membership Plugin, Ecommerce, User Registration Form,…)
- [CVE-2024-13119](https://cve.now/CVE-2024-13119.md): ProfilePress \< 4.15.20 - Admin+ Stored XSS (CVSS 4.8, Paid Membership Plugin, Ecommerce, User Registration Form,…)
- [CVE-2024-12586](https://cve.now/CVE-2024-12586.md): Chalet Montagne Com Tools \<= 2.7.8 - Reflected XSS (CVSS 6.1, Chalet-Montagne.com Tools)
- [CVE-2025-1070](https://cve.now/CVE-2025-1070.md): CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file (CVSS 7.2, Schneider Electric ASCO 5310 Single-Channel Remote Annuncia…)
- [CVE-2025-1060](https://cve.now/CVE-2025-1060.md): CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic (CVSS 8.7, Schneider Electric ASCO 5310 Single-Channel Remote Annuncia…)
- [CVE-2025-1059](https://cve.now/CVE-2025-1059.md): CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious pa (CVSS 8.7, Schneider Electric ASCO 5310 Single-Channel Remote Annuncia…)
- [CVE-2025-1058](https://cve.now/CVE-2025-1058.md): CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is do (CVSS 7.2, Schneider Electric ASCO 5310 Single-Channel Remote Annuncia…)
- [CVE-2024-10083](https://cve.now/CVE-2024-10083.md): CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of engineering workstation when specific driver in (CVSS 6.8, Schneider Electric Uni-Telway driver)
- [CVE-2024-10763](https://cve.now/CVE-2024-10763.md): Campress \<= 1.35 - Unauthenticated Local File Inclusion (CVSS 9.8, ApusTheme Campress)
- [CVE-2024-13770](https://cve.now/CVE-2024-13770.md): Puzzles | WP Magazine / Review with Store WordPress Theme + RTL \<= 4.2.4 - Unauthenticated PHP Object Injection (CVSS 8.1, ThemeREX Puzzles | WP Magazine / Review with Store WordPres…)
- [CVE-2025-0837](https://cve.now/CVE-2025-0837.md): Puzzles \<= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ThemeREX Puzzles | WP Magazine / Review with Store WordPres…)
- [CVE-2024-13229](https://cve.now/CVE-2024-13229.md): Rank Math SEO \<= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion (CVSS 4.3, rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…)
- [CVE-2024-13227](https://cve.now/CVE-2024-13227.md): Rank Math SEO – AI SEO Tools to Dominate SEO Rankings \<= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math API (CVSS 6.4, rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…)
- [CVE-2024-13644](https://cve.now/CVE-2024-13644.md): DethemeKit For Elementor \<= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery Widget (CVSS 6.4, DethemeKit for Elementor)
- [CVE-2025-0896](https://cve.now/CVE-2025-0896.md): Orthanc Server Missing Authentication for Critical Function (CVSS 9.2, Orthanc server)
- [CVE-2025-1198](https://cve.now/CVE-2025-1198.md): Insufficient Session Expiration in GitLab (CVSS 4.2, GitLab)
- [CVE-2024-7102](https://cve.now/CVE-2024-7102.md): Execution with Unnecessary Privileges in GitLab (CVSS 9.6, GitLab)
- [CVE-2024-8266](https://cve.now/CVE-2024-8266.md): Execution with Unnecessary Privileges in GitLab (CVSS 4.4, GitLab)
- [CVE-2025-25286](https://cve.now/CVE-2025-25286.md): Crayfish allows Remote Code Execution via Homarus Authorization header (CVSS 9.8, Islandora Crayfish · islandora/crayfish)
- [CVE-2023-34397](https://cve.now/CVE-2023-34397.md): Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB. (CVSS 7.5)
- [CVE-2023-34398](https://cve.now/CVE-2023-34398.md): Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. (CVSS 7.5)
- [CVE-2023-34399](https://cve.now/CVE-2023-34399.md): Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. (CVSS 9.8)
- [CVE-2023-34400](https://cve.now/CVE-2023-34400.md): Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. (CVSS 7.5)
- [CVE-2023-34401](https://cve.now/CVE-2023-34401.md): Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. (CVSS 3.7)
- [CVE-2023-34402](https://cve.now/CVE-2023-34402.md): Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. (CVSS 7.7)
- [CVE-2023-34403](https://cve.now/CVE-2023-34403.md): Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. (CVSS 4.9)
- [CVE-2023-34404](https://cve.now/CVE-2023-34404.md): Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. (CVSS 4.9)
- [CVE-2023-34406](https://cve.now/CVE-2023-34406.md): An issue was discovered on Mercedes Benz NTG 6. (CVSS 3.3)
- [CVE-2024-37600](https://cve.now/CVE-2024-37600.md): An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021. (CVSS 6.8)
- [CVE-2024-37601](https://cve.now/CVE-2024-37601.md): An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. (CVSS 4.6)
- [CVE-2024-37602](https://cve.now/CVE-2024-37602.md): An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021. (CVSS 4.6)
- [CVE-2024-37603](https://cve.now/CVE-2024-37603.md): An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. (CVSS 4.6)
- [CVE-2024-53309](https://cve.now/CVE-2024-53309.md): A stack-based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when an overly long string (CVSS 5.5)
- [CVE-2024-53310](https://cve.now/CVE-2024-53310.md): A Structured Exception Handler based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 whe (CVSS 5.5)
- [CVE-2024-53311](https://cve.now/CVE-2024-53311.md): A Stack buffer overflow in the arguments parameter in Immunity Inc. (CVSS 5.5)
- [CVE-2024-54951](https://cve.now/CVE-2024-54951.md): Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4)
- [CVE-2024-56908](https://cve.now/CVE-2024-56908.md): In Perfex Crm \< 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload\_sales\_file endpoint. (CVSS 6.8)
- [CVE-2024-57378](https://cve.now/CVE-2024-57378.md): Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability. (CVSS 7.3)
- [CVE-2024-57782](https://cve.now/CVE-2024-57782.md): An issue in Docker-proxy v18.09.0 allows attackers to cause a denial of service. (CVSS 6.8)
- [CVE-2025-22960](https://cve.now/CVE-2025-22960.md): A session hijacking vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters. (CVSS 8.0)
- [CVE-2025-22961](https://cve.now/CVE-2025-22961.md): A critical information disclosure vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters due (CVSS 8.0)
- [CVE-2025-22962](https://cve.now/CVE-2025-22962.md): A critical remote code execution (RCE) vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters (CVSS 7.2)
- [CVE-2025-25352](https://cve.now/CVE-2025-25352.md): A SQL Injection vulnerability was found in /admin/aboutus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execut (CVSS 7.2)
- [CVE-2025-25354](https://cve.now/CVE-2025-25354.md): A SQL Injection was found in /admin/admin-profile.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitr (CVSS 7.2)
- [CVE-2025-25355](https://cve.now/CVE-2025-25355.md): A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote att (CVSS 7.2)
- [CVE-2025-25356](https://cve.now/CVE-2025-25356.md): A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote att (CVSS 7.2)
- [CVE-2025-25357](https://cve.now/CVE-2025-25357.md): A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to exec (CVSS 7.2)
- [CVE-2025-25387](https://cve.now/CVE-2025-25387.md): A SQL Injection vulnerability was found in /admin/manage-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attacke (CVSS 7.2)
- [CVE-2025-25388](https://cve.now/CVE-2025-25388.md): A SQL Injection vulnerability was found in /admin/edit-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers (CVSS 9.8)
- [CVE-2025-25389](https://cve.now/CVE-2025-25389.md): A SQL Injection vulnerability was found in /admin/forgot-password.php in Phpgurukul Land Record System v1.0, which allows remote attackers t (CVSS 9.8)
- [CVE-2025-25897](https://cve.now/CVE-2025-25897.md): A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'ip' parameter at /userRpm/WanStaticIpV6CfgRpm.htm. (CVSS 7.5)
- [CVE-2025-25898](https://cve.now/CVE-2025-25898.md): A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm. (CVSS 7.5)
- [CVE-2025-25899](https://cve.now/CVE-2025-25899.md): A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'gw' parameter at /userRpm/WanDynamicIpV6CfgRpm.htm. (CVSS 3.5)
- [CVE-2025-25900](https://cve.now/CVE-2025-25900.md): A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the username and password parameters at /userRpm/PPPoEv6CfgRpm. (CVSS 4.9)
- [CVE-2025-25901](https://cve.now/CVE-2025-25901.md): A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/ (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.