CVEs published February 17, 2025
48 CVEs were published on February 17, 2025: 2 critical, 10 high.
- Published
- 48
- Critical
- 2
- High
- 10
- Medium
- 34
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- GNU elfutils
- 4
- MicroWord eScan Antivirus
- 4
- code-projects Real Estate Property Management System
- 3
- Learning Digital Orca HCM
- 3
- JIP InfoBridge Co. FileMegane
- 2
- Abacus Research AG Abacus
- 1
- Adnan Analytify
- 1
- bPlugins Timeline Block
- 1
- Codezips Gym Management System
- 1
- D-Link DIR-816
- 1
Critical 2
- CVE-2021-46686Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlieExtra Innovation acmailer CGI · Extra Innovation acmailer DB
- CVE-2025-1387Learning Digital Orca HCM - Improper AuthenticationLearning Digital Orca HCM
High 10
- CVE-2025-20075Server-side request forgery (SSRF) vulnerability exists in FileMegane versions above 3.0.0.0 prior to 3.4.0.0.JIP InfoBridge Co. FileMegane
- CVE-2025-21103Dell NetWorker Management Console, version(s) 19.11 through 19.11.0.3 & Versions prior to 19.10.0.7 contain(s) an improper neutralization ofDell NetWorker Management Console
- CVE-2025-23845WordPress ImageMeta Plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityERA404 ImageMeta
- CVE-2025-23840WordPress WP-NOTCAPTCHA Plugin <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilitywebjema WP-NOTCAPTCHA
- CVE-2024-13726Themes Coder <= 1.3.4 - Unauthenticated SQLiThemes Coder
- CVE-2024-13626VR Frases <= 3.0.1 - Reflected XSSVR-Frases
- CVE-2024-13625Tube Video Ads Lite <= 1.5.7 - Reflected XSSTube Video Ads Lite
- CVE-2025-0924WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scriptingmelapress WP Activity Log
- CVE-2025-1389Learning Digital Orca HCM - SQL InjectionLearning Digital Orca HCM
- CVE-2025-1388Learning Digital Orca HCM - Arbitrary File UploadLearning Digital Orca HCM
Medium, low and unrated 36
- CVE-2025-25055Authentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation.JIP InfoBridge Co. FileMegane
- CVE-2025-1392D-Link DIR-816 index.html cross site scriptingD-Link DIR-816
- CVE-2024-13879Stream <= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgeryxwp Stream
- CVE-2025-1391Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claimskeycloak-services · Red Hat Build of Keycloak +1
- CVE-2025-0714Insecure storage of sensitive information in MobaXTerm <25.0.Mobatek MobaXterm
- CVE-2025-26778WordPress Gallery Custom Links Plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerabilityJordy Meow Gallery
- CVE-2025-26775WordPress BEAR Plugin <= 1.1.4.4 - Cross Site Scripting (XSS) vulnerabilityRealMag777 BEAR
- CVE-2025-26773WordPress Analytify plugin <= 5.5.0 - Broken Access Control vulnerabilityAdnan Analytify
- CVE-2025-26772WordPress DethemeKit For Elementor plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerabilityDethemeKit For Elementor
- CVE-2025-26771WordPress SKT Blocks plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilitysonalsinha21 SKT Blocks
- CVE-2025-26770WordPress Waymark plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityJoe Waymark
- CVE-2025-26769WordPress Vertex Addons for Elementor plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityWebilia Vertex Addons for Elementor
- CVE-2025-26758WordPress Spotlight Social Feeds plugin <= 1.7.1 - Sensitive Data Exposure vulnerabilityRebelCode Spotlight Social Media Feeds
- CVE-2025-26754WordPress Timeline Block plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilitybPlugins Timeline Block
- CVE-2025-0001authenticated arbitrary file read vulnerabilityAbacus Research AG Abacus
- CVE-2025-1381code-projects Real Estate Property Management System ajax_city.php sql injectioncode-projects Real Estate Property Management System
- CVE-2025-1380Codezips Gym Management System del_plan.php sql injectionCodezips Gym Management System
- CVE-2025-1379code-projects Real Estate Property Management System CustomerReport.php sql injectioncode-projects Real Estate Property Management System
- CVE-2024-47935TXOne Networks StellarProtect (Legacy Mode), StellarEnforce, and Safe Lock Improper Validation of Integrity Check Value VulnerabilityTXOne Networks StellarProtect · TXOne Networks StellarEn… +1
- CVE-2025-1378radare2 rasm2 rasm2.c memory corruptionradare2
- CVE-2024-13627WP Touch Slider <= 2.2 - Reflected XSSOWL Carousel Slider
- CVE-2024-13608Track Logins <= 1.0 - Admin+ SQL InjectionTrack Logins
- CVE-2024-13603Wise Forms <= 1.2.0 - Unauthenticated Stored XSSWise Forms
- CVE-2025-1377GNU elfutils eu-strip strip.c gelf_getsymshndx denial of serviceGNU elfutils
- CVE-2025-1376GNU elfutils eu-strip elf_strptr.c elf_strptr denial of serviceGNU elfutils
- CVE-2025-1374code-projects Real Estate Property Management System search.php sql injectioncode-projects Real Estate Property Management System
- CVE-2025-1373FFmpeg MOV Parser mov.c mov_read_trak null pointer dereferenceFFmpeg
- CVE-2025-1372GNU elfutils eu-readelf readelf.c print_string_section buffer overflowGNU elfutils
- CVE-2025-26700Authentication bypass using an alternate path or channel issue exists in ”RoboForm Password Manager" App for Android versions prior to 9.7.4Siber Systems RoboForm Password Manager
- CVE-2025-1371GNU elfutils eu-read readelf.c handle_dynamic_symtab null pointer dereferenceGNU elfutils
- CVE-2025-1370MicroWorld eScan Antivirus Autoscan USB epsdaemon sprintf os command injectionMicroWorld eScan Antivirus
- CVE-2025-1369MicroWord eScan Antivirus USB Password os command injectionMicroWord eScan Antivirus
- CVE-2025-1368MicroWord eScan Antivirus mwav.conf ReadConfiguration buffer overflowMicroWord eScan Antivirus
- CVE-2025-1367MicroWord eScan Antivirus USB Password sprintf buffer overflowMicroWord eScan Antivirus
- CVE-2025-1366MicroWord eScan Antivirus VirusPopUp strcpy stack-based overflowMicroWord eScan Antivirus
- CVE-2024-25066RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-controlRSA Authentication Manager