# CVEs published 2025-02-17

48 CVEs were published on February 17, 2025: 2 critical, 10 high. Days are UTC.

- [CVE-2021-46686](https://cve.now/CVE-2021-46686.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlie (CVSS 9.8, Extra Innovation acmailer CGI · Extra Innovation acmailer DB)
- [CVE-2025-20075](https://cve.now/CVE-2025-20075.md): Server-side request forgery (SSRF) vulnerability exists in FileMegane versions above 3.0.0.0 prior to 3.4.0.0. (CVSS 7.2, JIP InfoBridge Co. FileMegane)
- [CVE-2025-25055](https://cve.now/CVE-2025-25055.md): Authentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation. (CVSS 5.3, JIP InfoBridge Co. FileMegane)
- [CVE-2025-1392](https://cve.now/CVE-2025-1392.md): D-Link DIR-816 index.html cross site scripting (CVSS 5.1, D-Link DIR-816)
- [CVE-2024-13879](https://cve.now/CVE-2024-13879.md): Stream \<= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery (CVSS 5.5, xwp Stream)
- [CVE-2025-1391](https://cve.now/CVE-2025-1391.md): Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims (CVSS 5.4, keycloak-services · Red Hat Build of Keycloak +1)
- [CVE-2025-21103](https://cve.now/CVE-2025-21103.md): Dell NetWorker Management Console, version(s) 19.11 through 19.11.0.3 & Versions prior to 19.10.0.7 contain(s) an improper neutralization of (CVSS 7.8, Dell NetWorker Management Console)
- [CVE-2025-0714](https://cve.now/CVE-2025-0714.md): Insecure storage of sensitive information in MobaXTerm \<25.0. (CVSS 6.5, Mobatek MobaXterm)
- [CVE-2025-23845](https://cve.now/CVE-2025-23845.md): WordPress ImageMeta Plugin \<= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ERA404 ImageMeta)
- [CVE-2025-23840](https://cve.now/CVE-2025-23840.md): WordPress WP-NOTCAPTCHA Plugin \<= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, webjema WP-NOTCAPTCHA)
- [CVE-2025-26778](https://cve.now/CVE-2025-26778.md): WordPress Gallery Custom Links Plugin \<= 2.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Jordy Meow Gallery)
- [CVE-2025-26775](https://cve.now/CVE-2025-26775.md): WordPress BEAR Plugin \<= 1.1.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, RealMag777 BEAR)
- [CVE-2025-26773](https://cve.now/CVE-2025-26773.md): WordPress Analytify plugin \<= 5.5.0 - Broken Access Control vulnerability (CVSS 4.3, Adnan Analytify)
- [CVE-2025-26772](https://cve.now/CVE-2025-26772.md): WordPress DethemeKit For Elementor plugin \<= 2.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DethemeKit For Elementor)
- [CVE-2025-26771](https://cve.now/CVE-2025-26771.md): WordPress SKT Blocks plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sonalsinha21 SKT Blocks)
- [CVE-2025-26770](https://cve.now/CVE-2025-26770.md): WordPress Waymark plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Joe Waymark)
- [CVE-2025-26769](https://cve.now/CVE-2025-26769.md): WordPress Vertex Addons for Elementor plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Webilia Vertex Addons for Elementor)
- [CVE-2025-26758](https://cve.now/CVE-2025-26758.md): WordPress Spotlight Social Feeds plugin \<= 1.7.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, RebelCode Spotlight Social Media Feeds)
- [CVE-2025-26754](https://cve.now/CVE-2025-26754.md): WordPress Timeline Block plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Timeline Block)
- [CVE-2025-0001](https://cve.now/CVE-2025-0001.md): authenticated arbitrary file read vulnerability (CVSS 6.5, Abacus Research AG Abacus)
- [CVE-2025-1381](https://cve.now/CVE-2025-1381.md): code-projects Real Estate Property Management System ajax\_city.php sql injection (CVSS 5.3, code-projects Real Estate Property Management System)
- [CVE-2025-1380](https://cve.now/CVE-2025-1380.md): Codezips Gym Management System del\_plan.php sql injection (CVSS 5.3, Codezips Gym Management System)
- [CVE-2025-1379](https://cve.now/CVE-2025-1379.md): code-projects Real Estate Property Management System CustomerReport.php sql injection (CVSS 5.3, code-projects Real Estate Property Management System)
- [CVE-2024-47935](https://cve.now/CVE-2024-47935.md): TXOne Networks StellarProtect (Legacy Mode), StellarEnforce, and Safe Lock Improper Validation of Integrity Check Value Vulnerability (CVSS 6.7, TXOne Networks StellarProtect · TXOne Networks StellarEn… +1)
- [CVE-2024-13726](https://cve.now/CVE-2024-13726.md): Themes Coder \<= 1.3.4 - Unauthenticated SQLi (CVSS 8.6, Themes Coder)
- [CVE-2025-1378](https://cve.now/CVE-2025-1378.md): radare2 rasm2 rasm2.c memory corruption (CVSS 4.8, radare2)
- [CVE-2024-13627](https://cve.now/CVE-2024-13627.md): WP Touch Slider \<= 2.2 - Reflected XSS (CVSS 4.7, OWL Carousel Slider)
- [CVE-2024-13626](https://cve.now/CVE-2024-13626.md): VR Frases \<= 3.0.1 - Reflected XSS (CVSS 7.1, VR-Frases)
- [CVE-2024-13625](https://cve.now/CVE-2024-13625.md): Tube Video Ads Lite \<= 1.5.7 - Reflected XSS (CVSS 7.1, Tube Video Ads Lite)
- [CVE-2024-13608](https://cve.now/CVE-2024-13608.md): Track Logins \<= 1.0 - Admin+ SQL Injection (CVSS 4.7, Track Logins)
- [CVE-2024-13603](https://cve.now/CVE-2024-13603.md): Wise Forms \<= 1.2.0 - Unauthenticated Stored XSS (CVSS 6.1, Wise Forms)
- [CVE-2025-1377](https://cve.now/CVE-2025-1377.md): GNU elfutils eu-strip strip.c gelf\_getsymshndx denial of service (CVSS 4.8, GNU elfutils)
- [CVE-2025-1376](https://cve.now/CVE-2025-1376.md): GNU elfutils eu-strip elf\_strptr.c elf\_strptr denial of service (CVSS 2.0, GNU elfutils)
- [CVE-2025-0924](https://cve.now/CVE-2025-0924.md): WP Activity Log \<= 5.2.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, melapress WP Activity Log)
- [CVE-2025-1389](https://cve.now/CVE-2025-1389.md): Learning Digital Orca HCM - SQL Injection (CVSS 8.8, Learning Digital Orca HCM)
- [CVE-2025-1374](https://cve.now/CVE-2025-1374.md): code-projects Real Estate Property Management System search.php sql injection (CVSS 5.3, code-projects Real Estate Property Management System)
- [CVE-2025-1388](https://cve.now/CVE-2025-1388.md): Learning Digital Orca HCM - Arbitrary File Upload (CVSS 8.8, Learning Digital Orca HCM)
- [CVE-2025-1387](https://cve.now/CVE-2025-1387.md): Learning Digital Orca HCM - Improper Authentication (CVSS 9.8, Learning Digital Orca HCM)
- [CVE-2025-1373](https://cve.now/CVE-2025-1373.md): FFmpeg MOV Parser mov.c mov\_read\_trak null pointer dereference (CVSS 4.8, FFmpeg)
- [CVE-2025-1372](https://cve.now/CVE-2025-1372.md): GNU elfutils eu-readelf readelf.c print\_string\_section buffer overflow (CVSS 4.8, GNU elfutils)
- [CVE-2025-26700](https://cve.now/CVE-2025-26700.md): Authentication bypass using an alternate path or channel issue exists in ”RoboForm Password Manager" App for Android versions prior to 9.7.4 (CVSS 5.2, Siber Systems RoboForm Password Manager)
- [CVE-2025-1371](https://cve.now/CVE-2025-1371.md): GNU elfutils eu-read readelf.c handle\_dynamic\_symtab null pointer dereference (CVSS 4.8, GNU elfutils)
- [CVE-2025-1370](https://cve.now/CVE-2025-1370.md): MicroWorld eScan Antivirus Autoscan USB epsdaemon sprintf os command injection (CVSS 4.8, MicroWorld eScan Antivirus)
- [CVE-2025-1369](https://cve.now/CVE-2025-1369.md): MicroWord eScan Antivirus USB Password os command injection (CVSS 2.0, MicroWord eScan Antivirus)
- [CVE-2025-1368](https://cve.now/CVE-2025-1368.md): MicroWord eScan Antivirus mwav.conf ReadConfiguration buffer overflow (CVSS 4.6, MicroWord eScan Antivirus)
- [CVE-2025-1367](https://cve.now/CVE-2025-1367.md): MicroWord eScan Antivirus USB Password sprintf buffer overflow (CVSS 4.8, MicroWord eScan Antivirus)
- [CVE-2025-1366](https://cve.now/CVE-2025-1366.md): MicroWord eScan Antivirus VirusPopUp strcpy stack-based overflow (CVSS 4.8, MicroWord eScan Antivirus)
- [CVE-2024-25066](https://cve.now/CVE-2024-25066.md): RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-control (CVSS 4.3, RSA Authentication Manager)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.