# CVEs published 2025-02-14

132 CVEs were published on February 14, 2025: 8 critical, 72 high. Days are UTC.

- [CVE-2024-5462](https://cve.now/CVE-2024-5462.md): Brocade Fabric OS may capture SNMP Passwords in clear text (CVSS 5.3, Brocade Fabric OS)
- [CVE-2024-4282](https://cve.now/CVE-2024-4282.md): Weak TLS Ciphers on Brocade SANnav OVA SSH port 22 (CVSS 8.2, Brocade SANnav)
- [CVE-2024-10405](https://cve.now/CVE-2024-10405.md): Weak TLS Ciphers on Brocade SANnav port 443 & 18082 (CVSS 6.9, Brocade SANnav)
- [CVE-2025-21401](https://cve.now/CVE-2025-21401.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 4.5, Microsoft Edge)
- [CVE-2022-28693](https://cve.now/CVE-2022-28693.md): Unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized user to potentially e (CVSS 4.7, Intel(R) Processors)
- [CVE-2022-26083](https://cve.now/CVE-2022-26083.md): Generation of weak initialization vector in an Intel(R) IPP Cryptography software library before version 2021.5 may allow an unauthenticated (CVSS 7.5, Intel(R) IPP Cryptography software library)
- [CVE-2025-0593](https://cve.now/CVE-2025-0593.md): SICK Lector8xx and InspectorP8xx vulnerable for code execution (CVSS 8.8, SICK AG SICK Lector8xx · SICK AG SICK InspectorP8xx)
- [CVE-2024-31144](https://cve.now/CVE-2024-31144.md): Xapi: Metadata injection attack against backup/restore functionality (CVSS 3.8, Xen Project Xen)
- [CVE-2025-0592](https://cve.now/CVE-2025-0592.md): SICK Lector8xx and InspectorP8xx vulnerable for code execution (CVSS 8.8, SICK AG SICK Lector8xx · SICK AG SICK InspectorP8xx)
- [CVE-2025-25290](https://cve.now/CVE-2025-25290.md): @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking (CVSS 5.3, octokit request.js · @octokit/request)
- [CVE-2025-25289](https://cve.now/CVE-2025-25289.md): @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking (CVSS 5.3, octokit request-error.js · @octokit/request-error)
- [CVE-2025-25288](https://cve.now/CVE-2025-25288.md): @octokit/plugin-paginate-rest has a Regular Expression in iterator that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking (CVSS 5.3, octokit plugin-paginate-rest.js · @octokit/plugin-paginate-…)
- [CVE-2025-25285](https://cve.now/CVE-2025-25285.md): @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking (CVSS 5.3, octokit endpoint.js · @octokit/endpoint)
- [CVE-2025-25304](https://cve.now/CVE-2025-25304.md): Vega allows Cross-site Scripting via the vlSelectionTuples function (CVSS 6.9, vega · vega-selections)
- [CVE-2025-25297](https://cve.now/CVE-2025-25297.md): Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint (CVSS 8.6, HumanSignal label-studio · label-studio)
- [CVE-2025-25296](https://cve.now/CVE-2025-25296.md): Label Studio allows Cross-Site Scripting (XSS) via GET request to \`/projects/upload-example\` endpoint (CVSS 6.1, HumanSignal label-studio · label-studio)
- [CVE-2025-0503](https://cve.now/CVE-2025-0503.md): Leaked User IDs and Metadata of Deleted DMs (CVSS 3.1, Mattermost)
- [CVE-2025-26508](https://cve.now/CVE-2025-26508.md): Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers – Potential Remote Code Execution and Potential Elevation of Privilege (CVSS 8.3, Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJe…)
- [CVE-2025-26507](https://cve.now/CVE-2025-26507.md): Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers – Potential Remote Code Execution and Potential Elevation of Privilege (CVSS 6.3, Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJe…)
- [CVE-2025-26506](https://cve.now/CVE-2025-26506.md): Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers – Potential Remote Code Execution and Potential Elevation of Privilege (CVSS 9.2, Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJe…)
- [CVE-2025-25295](https://cve.now/CVE-2025-25295.md): Label Studio has a Path Traversal Vulnerability via image Field (CVSS 8.7, HumanSignal label-studio · label-studio-sdk)
- [CVE-2025-25206](https://cve.now/CVE-2025-25206.md): Incorrect input validation could allow an authenticated user to read sensitive information (CVSS 8.3, elabftw)
- [CVE-2025-25204](https://cve.now/CVE-2025-25204.md): \`gh attestation verify\` returns incorrect exit code during verification if no attestations are present (CVSS 6.3, cli · github.com/cli/cli +1)
- [CVE-2024-8893](https://cve.now/CVE-2024-8893.md): Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. (CVSS 7.3, GoodWe Technologies Co. GW1500‑XS)
- [CVE-2024-3220](https://cve.now/CVE-2024-3220.md): Default mimetype known files writeable on Windows (CVSS 2.3, Python Software Foundation CPython · python +1)
- [CVE-2024-56463](https://cve.now/CVE-2024-56463.md): IBM QRadar SIEM cross-site scripting (CVSS 4.8, IBM QRadar SIEM)
- [CVE-2024-56477](https://cve.now/CVE-2024-56477.md): IBM Power Hardware Management Console directory traversal (CVSS 6.5, IBM Power Hardware Management Console)
- [CVE-2024-52895](https://cve.now/CVE-2024-52895.md): IBM i denial of service (CVSS 6.5, IBM i)
- [CVE-2024-56180](https://cve.now/CVE-2024-56180.md): Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution (CVSS 9.8, Apache Software Foundation Apache EventMesh · org.apache.ev…)
- [CVE-2024-12651](https://cve.now/CVE-2024-12651.md): Sensitive Data Exposure in PTT Inc.'s HGS Mobile App (CVSS 8.5, PTT HGS Mobile App)
- [CVE-2025-0178](https://cve.now/CVE-2025-0178.md): WatchGaurd Firebox Host Header Injection Vulnerability (CVSS 5.1, WatchGuard Fireware OS)
- [CVE-2025-1239](https://cve.now/CVE-2025-1239.md): WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Blocked Sites List (CVSS 4.8, WatchGuard Fireware OS)
- [CVE-2025-1071](https://cve.now/CVE-2025-1071.md): WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker Module (CVSS 4.8, WatchGuard Fireware OS)
- [CVE-2024-13152](https://cve.now/CVE-2024-13152.md): SQLi in BSS Software's Mobuy Online Machinery Monitoring Panel (CVSS 10.0, BSS Software Mobuy Online Machinery Monitoring Panel)
- [CVE-2025-23905](https://cve.now/CVE-2025-23905.md): WordPress Admin Options Pages plugin \<= 0.9.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Johannes van Poelgeest Admin Options Pages)
- [CVE-2025-22705](https://cve.now/CVE-2025-22705.md): WordPress Disqus Popular Posts plugin \<= 2.1.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, godthor Disqus Popular Posts)
- [CVE-2025-22702](https://cve.now/CVE-2025-22702.md): WordPress Photography Theme \<= 7.7.2 - Broken Access Control Vulnerability (CVSS 6.3, ThemeGoods Photography)
- [CVE-2025-22698](https://cve.now/CVE-2025-22698.md): WordPress Accessibility Suite by Ability, Inc plugin \<= 4.18 - Multiple Broken Access Control vulnerability (CVSS 6.3, Ability Accessibility Suite)
- [CVE-2024-52500](https://cve.now/CVE-2024-52500.md): WordPress Monetag Official Plugin plugin \<= 1.1.3 - Broken Access Control vulnerability (CVSS 7.2, monetagwp Monetag Official Plugin)
- [CVE-2025-24692](https://cve.now/CVE-2025-24692.md): WordPress Bulk Menu Edit plugin \<= 1.3 - Broken Access Control vulnerability (CVSS 7.1, M.Code Bulk Menu Edit)
- [CVE-2025-24688](https://cve.now/CVE-2025-24688.md): WordPress WP Mailster Plugin \<= 1.8.20.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, brandtoss WP Mailster)
- [CVE-2025-24700](https://cve.now/CVE-2025-24700.md): WordPress WP Event Aggregator Plugin \<= 1.8.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Xylus Themes WP Event Aggregator)
- [CVE-2025-24699](https://cve.now/CVE-2025-24699.md): WordPress WP Coder Plugin \<= 3.6 - CSRF to Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Wow-Company WP Coder)
- [CVE-2025-24641](https://cve.now/CVE-2025-24641.md): WordPress Better WishList API plugin \<= 1.1.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rickonline\_nl Better WishList API)
- [CVE-2025-24617](https://cve.now/CVE-2025-24617.md): WordPress AcyMailing Plugin \< 9.11.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AcyMailing Newsletter Team AcyMailing SMTP Newsletter)
- [CVE-2025-24616](https://cve.now/CVE-2025-24616.md): WordPress Uix Page Builder Plugin \<= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, UIUX Lab Uix Page Builder)
- [CVE-2025-24615](https://cve.now/CVE-2025-24615.md): WordPress Analytics Cat Plugin \<= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fatcatapps Analytics Cat)
- [CVE-2025-24614](https://cve.now/CVE-2025-24614.md): WordPress Post Timeline Plugin \<= 2.3.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Agile Logix Post Timeline)
- [CVE-2025-24607](https://cve.now/CVE-2025-24607.md): WordPress IdeaPush plugin \<= 8.71 - Broken Access Control vulnerability (CVSS 5.8, Northern Beaches Websites IdeaPush)
- [CVE-2025-24592](https://cve.now/CVE-2025-24592.md): WordPress SysBasics Customize My Account for WooCommerce plugin \<= 2.8.22 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SysBasics Customize My Account for WooCommerce)
- [CVE-2025-24567](https://cve.now/CVE-2025-24567.md): WordPress WP Mailster plugin \<= 1.8.16.0 - Sensitive Data Exposure vulnerability (CVSS 6.5, brandtoss WP Mailster)
- [CVE-2025-24566](https://cve.now/CVE-2025-24566.md): WordPress Intro Tour Tutorial DeepPresentation plugin \<= 6.5.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tomáš Groulík Intro Tour Tutorial DeepPresentation)
- [CVE-2025-24565](https://cve.now/CVE-2025-24565.md): WordPress WP2LEADS plugin \<= 3.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Saleswonder Team: Tobias WP2LEADS)
- [CVE-2025-24564](https://cve.now/CVE-2025-24564.md): WordPress Contact Form With Shortcode plugin \<= 4.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, aviplugins.com Contact Form With Shortcode)
- [CVE-2025-24558](https://cve.now/CVE-2025-24558.md): WordPress CRM Perks plugin \<= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CRM Perks)
- [CVE-2025-24554](https://cve.now/CVE-2025-24554.md): WordPress AWcode Toolkit plugin \<= 1.0.14 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AWcode Toolkit)
- [CVE-2025-23857](https://cve.now/CVE-2025-23857.md): WordPress Essential WP Real Estate Plugin \<= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SmartDataSoft Essential WP Real Estate)
- [CVE-2025-23853](https://cve.now/CVE-2025-23853.md): WordPress NoFollow Free plugin \<= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, michelem NoFollow Free)
- [CVE-2025-23851](https://cve.now/CVE-2025-23851.md): WordPress Coronavirus (COVID-19) Outbreak Data Widgets Plugin \<= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Khushwant Singh Coronavirus (COVID-19) Outbreak Data Widgets)
- [CVE-2025-23790](https://cve.now/CVE-2025-23790.md): WordPress Easy Code Placement Plugin \<= 18.11 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wassereimer Easy Code Placement)
- [CVE-2025-23789](https://cve.now/CVE-2025-23789.md): WordPress URL Shortener WooCommerce Plugin \<= 9.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tahminajannat URL Shortener | Conversion Tracking | AB Tes…)
- [CVE-2025-23788](https://cve.now/CVE-2025-23788.md): WordPress Easy Filter Plugin \<= 1.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Roni Saha Easy Filter)
- [CVE-2025-23787](https://cve.now/CVE-2025-23787.md): WordPress Easy Bet Plugin \<= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Foxskav Easy Bet)
- [CVE-2025-23786](https://cve.now/CVE-2025-23786.md): WordPress Email to Download Plugin \<= 3.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DuoGeek Email to Download)
- [CVE-2025-23771](https://cve.now/CVE-2025-23771.md): WordPress Push Notification for Post and BuddyPress plugin \<= 2.11 - Settings Change vulnerability (CVSS 6.5, Murali Push Notification for Post and BuddyPress)
- [CVE-2025-23766](https://cve.now/CVE-2025-23766.md): WordPress OPSI Israel Domestic Shipments plugin \<= 2.8.2 - Broken Access Control vulnerability (CVSS 6.5, ashamil OPSI Israel Domestic Shipments)
- [CVE-2025-23751](https://cve.now/CVE-2025-23751.md): WordPress Data Dash plugin \<= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Think201 Data Dash)
- [CVE-2025-23750](https://cve.now/CVE-2025-23750.md): WordPress Custom Widget Creator plugin \<= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, devbunchuk Custom Widget Creator)
- [CVE-2025-23748](https://cve.now/CVE-2025-23748.md): WordPress Singsys -Awesome Gallery plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Singsys -Awesome Gallery)
- [CVE-2025-23742](https://cve.now/CVE-2025-23742.md): WordPress Podamibe Twilio Private Call plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Podamibe Nepal Podamibe Twilio Private Call)
- [CVE-2025-23658](https://cve.now/CVE-2025-23658.md): WordPress Advanced Angular Contact Form plugin \<= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tauhidul Alam Advanced Angular Contact Form)
- [CVE-2025-23657](https://cve.now/CVE-2025-23657.md): WordPress WordPress-to-candidate for Salesforce CRM plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RusAlex WordPress-to-candidate for Salesforce CRM)
- [CVE-2025-23655](https://cve.now/CVE-2025-23655.md): WordPress Contact Form 7 – Paystack Add-on plugin \<= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, crystalwebpro Contact Form 7 – Paystack Add-on)
- [CVE-2025-23653](https://cve.now/CVE-2025-23653.md): WordPress Form To Online Booking plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Nabeel Tahir Form To Online Booking)
- [CVE-2025-23652](https://cve.now/CVE-2025-23652.md): WordPress Add custom content after post plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Fabio Zuanon Add custom content after post)
- [CVE-2025-23651](https://cve.now/CVE-2025-23651.md): WordPress Scroll Top plugin \<= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, adamskaat Scroll Top)
- [CVE-2025-23650](https://cve.now/CVE-2025-23650.md): WordPress Tidy.ro plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, razvypp Tidy.ro)
- [CVE-2025-23648](https://cve.now/CVE-2025-23648.md): WordPress AdsMiddle plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wjharil AdsMiddle)
- [CVE-2025-23647](https://cve.now/CVE-2025-23647.md): WordPress WP-Clap plugin \<= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ariagle WP-Clap)
- [CVE-2025-23646](https://cve.now/CVE-2025-23646.md): WordPress Library Instruction Recorder plugin \<= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Matt Brooks Library Instruction Recorder)
- [CVE-2025-23598](https://cve.now/CVE-2025-23598.md): WordPress Recip.ly plugin \<= 1.1.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, craig.edmunds@gmail.com Recip.ly)
- [CVE-2025-23571](https://cve.now/CVE-2025-23571.md): WordPress Internal Links Generator plugin \<= 3.51 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, makong Internal Links Generator)
- [CVE-2025-23568](https://cve.now/CVE-2025-23568.md): WordPress WP Login Attempt Log plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fredsted WP Login Attempt Log)
- [CVE-2025-23534](https://cve.now/CVE-2025-23534.md): WordPress WPLingo plugin \<= 1.1.2 - Arbitrary Content Deletion vulnerability (CVSS 6.5, Mark Winiarski WPLingo)
- [CVE-2025-23525](https://cve.now/CVE-2025-23525.md): WordPress Kv Compose Email From Dashboard plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kvvaradha Kv Compose Email From Dashboard)
- [CVE-2025-23523](https://cve.now/CVE-2025-23523.md): WordPress HSS Embed Streaming Video plugin \<= 3.23 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, hoststreamsell HSS Embed Streaming Video)
- [CVE-2025-23492](https://cve.now/CVE-2025-23492.md): WordPress 淘宝客插件 plugin \<= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CantonBolo WordPress 淘宝客插件)
- [CVE-2025-23474](https://cve.now/CVE-2025-23474.md): WordPress Live Dashboard plugin \<= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mike Martel Live Dashboard)
- [CVE-2025-23431](https://cve.now/CVE-2025-23431.md): WordPress Envato Affiliater plugin \<= 1.2.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, khaninejad Envato Affiliater)
- [CVE-2025-23428](https://cve.now/CVE-2025-23428.md): WordPress QMean plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Arash Safari QMean – WordPress Did You Mean)
- [CVE-2025-0867](https://cve.now/CVE-2025-0867.md): Privilege Escalation in MEAC300 (CVSS 9.9, SICK AG SICK MEAC300)
- [CVE-2025-26524](https://cve.now/CVE-2025-26524.md): No Rate Limiting Vulnerability in RupeeWeb trading platform (CVSS 5.1, Rupeeseed Technology Ventures RupeeWeb)
- [CVE-2025-26523](https://cve.now/CVE-2025-26523.md): Insufficient Authorization Vulnerability in RupeeWeb trading platform (CVSS 7.4, Rupeeseed Technology Ventures RupeeWeb)
- [CVE-2025-26522](https://cve.now/CVE-2025-26522.md): Authentication Bypass Vulnerability in RupeeWeb trading platform (CVSS 7.5, Rupeeseed Technology Ventures RupeeWeb)
- [CVE-2025-0821](https://cve.now/CVE-2025-0821.md): Bit Assist \<= 1.5.2 - Authenticated (Subscriber+) SQL Injection via id Parameter (CVSS 6.5, bitpressadmin Chat Widget: Floating Customer Support Button…)
- [CVE-2024-13791](https://cve.now/CVE-2024-13791.md): Bit Assist \<= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function (CVSS 4.9, bitpressadmin Chat Widget: Floating Customer Support Button…)
- [CVE-2024-52577](https://cve.now/CVE-2024-52577.md): Apache Ignite: Possible RCE when deserializing incoming messages by the server node (CVSS 9.5, Apache Software Foundation Apache Ignite · org.apache.ignit…)
- [CVE-2024-13735](https://cve.now/CVE-2024-13735.md): HurryTimer \<= 2.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Name (CVSS 6.4, nlemsieh HurryTimer – An Scarcity and Urgency Countdown Tim…)
- [CVE-2025-1298](https://cve.now/CVE-2025-1298.md): Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover. (CVSS 9.8, TECNO com.transsion.carlcare)
- [CVE-2025-22630](https://cve.now/CVE-2025-22630.md): WordPress Widget Options Plugin \<= 4.1.0 - Arbitrary Code Execution vulnerability (CVSS 9.9, Marketing Fire Widget Options)
- [CVE-2024-9601](https://cve.now/CVE-2024-9601.md): Qubely – Advanced Gutenberg Blocks \<= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID' (CVSS 6.5, themeum Qubely – Advanced Gutenberg Blocks)
- [CVE-2024-7052](https://cve.now/CVE-2024-7052.md): Forminator \< 1.38.3 - Admin+ Stored XSS (CVSS 4.8, Forminator Forms)
- [CVE-2024-13493](https://cve.now/CVE-2024-13493.md): Sensly Online Presence \<= 0.6 - Admin+ Stored XSS (CVSS 4.8, Sensly Online Presence)
- [CVE-2024-13692](https://cve.now/CVE-2024-13692.md): Return Refund and Exchange For WooCommerce \<= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference (CVSS 5.4, wpswings Return Refund and Exchange For WooCommerce)
- [CVE-2024-13641](https://cve.now/CVE-2024-13641.md): Return Refund and Exchange For WooCommerce \<= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 5.9, wpswings Return Refund and Exchange For WooCommerce)
- [CVE-2024-2240](https://cve.now/CVE-2024-2240.md): Docker implementation in Brocade SANnav is missing Audit Rules. (CVSS 8.6, Brocade SANnav)
- [CVE-2025-23406](https://cve.now/CVE-2025-23406.md): Out-of-bounds read vulnerability caused by improper checking of TCP MSS option values exists in Cente middleware TCP/IP Network Series, whic (CVSS 5.3, DMG MORI Digital Co., LTD. and NXTech Co. Cente TCP/IPv4 ·…)
- [CVE-2025-1053](https://cve.now/CVE-2025-1053.md): Brocade SANnav encryption key is logged in the debug logs (CVSS 8.6, Brocade SANnav)
- [CVE-2024-55904](https://cve.now/CVE-2024-55904.md): IBM DevOps Deploy / IBM UrbanCode Deploy command injection (CVSS 7.2, IBM UrbanCode Deploy · IBM DevOps Deploy)
- [CVE-2024-10404](https://cve.now/CVE-2024-10404.md): Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave (CVSS 5.5, Brocade SANnav)
- [CVE-2024-56973](https://cve.now/CVE-2024-56973.md): Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary (CVSS 9.8)
- [CVE-2024-57725](https://cve.now/CVE-2024-57725.md): An issue in the Arcadyan Livebox Fibra PRV3399B\_B\_LT allows a remote or local attacker to modify the GPON link value without authentication, (CVSS 6.5)
- [CVE-2024-57778](https://cve.now/CVE-2024-57778.md): An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from st (CVSS 8.8)
- [CVE-2024-57790](https://cve.now/CVE-2024-57790.md): IXON B.V. (CVSS 5.4)
- [CVE-2024-57969](https://cve.now/CVE-2024-57969.md): app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. (CVSS 4.3, MISP)
- [CVE-2025-25740](https://cve.now/CVE-2025-25740.md): D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the PSK parameter in the SetQuickVPNSe (CVSS 5.5)
- [CVE-2025-25745](https://cve.now/CVE-2025-25745.md): D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetQuick (CVSS 8.8)
- [CVE-2025-25988](https://cve.now/CVE-2025-25988.md): Cross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custom Link title paramet (CVSS 4.8)
- [CVE-2025-25990](https://cve.now/CVE-2025-25990.md): Cross Site Scripting vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php c (CVSS 6.1)
- [CVE-2025-25991](https://cve.now/CVE-2025-25991.md): SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php componen (CVSS 5.1)
- [CVE-2025-25992](https://cve.now/CVE-2025-25992.md): SQL Injection vulnerability in FeMiner wms 1.0 allows a remote attacker to obtain sensitive information via the inquire\_inout\_item.php compo (CVSS 5.1)
- [CVE-2025-25993](https://cve.now/CVE-2025-25993.md): SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameter "itemid." (CVSS 5.1)
- [CVE-2025-25994](https://cve.now/CVE-2025-25994.md): SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, (CVSS 7.5)
- [CVE-2025-25997](https://cve.now/CVE-2025-25997.md): Directory Traversal vulnerability in FeMiner wms v.1.0 allows a remote attacker to obtain sensitive information via the databak.php componen (CVSS 7.5)
- [CVE-2025-26156](https://cve.now/CVE-2025-26156.md): A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attacke (CVSS 8.8)
- [CVE-2025-26157](https://cve.now/CVE-2025-26157.md): A SQL Injection vulnerability was found in /bpms/index.php in Source Code and Project Beauty Parlour Management System V1.1, which allows re (CVSS 5.9)
- [CVE-2025-26158](https://cve.now/CVE-2025-26158.md): A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the manage-employee.php page of Kashipara Online Attendance Management S (CVSS 5.6)
- [CVE-2025-26519](https://cve.now/CVE-2025-26519.md): musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrus (CVSS 8.1, musl-libc musl)
- [CVE-2025-26788](https://cve.now/CVE-2025-26788.md): StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction. (CVSS 8.4, StrongKey FIDO Server)
- [CVE-2025-26789](https://cve.now/CVE-2025-26789.md): An issue was discovered in Logpoint AgentX before 1.5.0. (CVSS 6.9, Logpoint AgentX)
- [CVE-2025-26791](https://cve.now/CVE-2025-26791.md): DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS). (CVSS 4.5, Cure53 DOMPurify · dompurify)
- [CVE-2025-26819](https://cve.now/CVE-2025-26819.md): Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections. (CVSS 8.6, getmonero Monero)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.