# CVEs published 2025-02-19

125 CVEs were published on February 19, 2025: 7 critical, 41 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-0112](https://cve.now/CVE-2025-0112.md): Cortex XDR Agent: Local Windows User Can Disable the Agent (CVSS 6.8, Palo Alto Networks Cortex XDR Agent)
- [CVE-2024-37363](https://cve.now/CVE-2024-37363.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 6.5, Hitachi Vantara Pentaho Data Integration & Analytics · Hita…)
- [CVE-2024-37362](https://cve.now/CVE-2024-37362.md): Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials (CVSS 6.3, Hitachi Vantara Pentaho Data Integration & Analytics · Hita…)
- [CVE-2024-6697](https://cve.now/CVE-2024-6697.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges (CVSS 6.5, Hitachi Vantara Pentaho Data Integration & Analytics · Hita…)
- [CVE-2024-12284](https://cve.now/CVE-2024-12284.md): Authenticated privilege escalation (CVSS 8.8, NetScaler Console · NetScaler Agent)
- [CVE-2024-6696](https://cve.now/CVE-2024-6696.md): Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Control (CVSS 4.9, Hitachi Vantara Pentaho Data Integration & Analytics · Hita…)
- [CVE-2024-37361](https://cve.now/CVE-2024-37361.md): Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data (CVSS 9.9, Hitachi Vantara Pentaho Data Integration & Analytics · Hita…)
- [CVE-2024-37360](https://cve.now/CVE-2024-37360.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 4.4, Hitachi Vantara Pentaho Data Integration & Analytics · Hita…)
- [CVE-2024-37359](https://cve.now/CVE-2024-37359.md): Hitachi Vantara Pentaho Business Analytics Server – Server Side Request Forgery (CVSS 8.6, Hitachi Vantara Pentaho Data Integration & Analytics · Hita…)
- [CVE-2024-5705](https://cve.now/CVE-2024-5705.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 8.8, Hitachi Vantara Pentaho Data Integration & Analytics · Hita…)
- [CVE-2024-5706](https://cve.now/CVE-2024-5706.md): Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection') (CVSS 8.8, Hitachi Vantara Pentaho Data Integration & Analytics · Hita…)
- [CVE-2025-24989](https://cve.now/CVE-2025-24989.md): Microsoft Power Pages Elevation of Privilege Vulnerability (CVSS 8.2, KEV, Microsoft Power Pages)
- [CVE-2025-21355](https://cve.now/CVE-2025-21355.md): Microsoft Bing Remote Code Execution Vulnerability (CVSS 8.6, Microsoft Bing)
- [CVE-2025-27092](https://cve.now/CVE-2025-27092.md): Path Traversal Vulnerability in GHOSTS Photo Retrieval Endpoint (CVSS 8.7, cmu-sei GHOSTS)
- [CVE-2025-27090](https://cve.now/CVE-2025-27090.md): Server-Side Request Forgery (SSRF) in sliver teamserver (CVSS 6.9, BishopFox sliver · github.com/bishopfox/sliver)
- [CVE-2025-25196](https://cve.now/CVE-2025-25196.md): OpenFGA Authorization Bypass (CVSS 5.8, openfga · github.com/openfga/openfga)
- [CVE-2025-0677](https://cve.now/CVE-2025-0677.md): Grub2: ufs: integer overflow may lead to heap based out-of-bounds write when handling symlinks (CVSS 6.4, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2025-0624](https://cve.now/CVE-2025-0624.md): Grub2: net: out-of-bounds write in grub\_net\_search\_config\_file() (CVSS 7.6, grub2 · Red Hat Enterprise Linux 7 Extended Lifecycle Su… +2)
- [CVE-2025-0893](https://cve.now/CVE-2025-0893.md): Symantec Diagnostic Tool (SymDiag), prior to 3.0.79, may be susceptible to a Privilege Escalation vulnerability. (CVSS 7.8, Symantec Diagnostic Tool)
- [CVE-2025-1118](https://cve.now/CVE-2025-1118.md): Grub2: commands/dump: the dump command is not in lockdown when secure boot is enabled (CVSS 4.4, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2024-45777](https://cve.now/CVE-2024-45777.md): Grub2: grub-core/gettext: integer overflow leads to heap oob write. (CVSS 6.7, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2024-53974](https://cve.now/CVE-2024-53974.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-24806](https://cve.now/CVE-2025-24806.md): Regulation applies separately to Username-based logins to Email-based logins in authelia (CVSS 2.3, authelia · github.com/authelia/authelia +1)
- [CVE-2025-1006](https://cve.now/CVE-2025-1006.md): Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a cr (CVSS 8.8, Google Chrome)
- [CVE-2025-1426](https://cve.now/CVE-2025-1426.md): Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corrup (CVSS 8.8, Google Chrome)
- [CVE-2025-0999](https://cve.now/CVE-2025-0999.md): Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a c (CVSS 8.8, Google Chrome)
- [CVE-2025-24965](https://cve.now/CVE-2025-24965.md): .krun\_config.json symlink attack creates or overwrites file on the host in crun (CVSS 8.5, containers crun)
- [CVE-2024-52541](https://cve.now/CVE-2024-52541.md): Dell Client Platform BIOS contains a Weak Authentication vulnerability. (CVSS 8.2, Dell Client Platform BIOS)
- [CVE-2025-27089](https://cve.now/CVE-2025-27089.md): Overlapping policies allow update to non-allowed fields in directus (CVSS 5.4, directus · @directus/api)
- [CVE-2023-47160](https://cve.now/CVE-2023-47160.md): IBM Cognos Controller XML external entity injection (CVSS 8.2, IBM Cognos Controller · IBM Controller)
- [CVE-2025-20211](https://cve.now/CVE-2025-20211.md): Cisco BroadWorks Application Delivery Platform Software Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco BroadWorks)
- [CVE-2025-20153](https://cve.now/CVE-2025-20153.md): Cisco ESA mail Bypass (CVSS 5.8, Cisco Secure Email)
- [CVE-2025-20158](https://cve.now/CVE-2025-20158.md): Cisco Video Phone 8875 and Desk Phone 9800 Series Information Disclosure Vulnerability (CVSS 4.4, Cisco Session Initiation Protocol (SIP) Software)
- [CVE-2024-28777](https://cve.now/CVE-2024-28777.md): IBM Cognos Controller code execution (CVSS 8.8, IBM Cognos Controller · IBM Controller)
- [CVE-2024-28776](https://cve.now/CVE-2024-28776.md): IBM Cognos Controller cross-site scripting (CVSS 5.4, IBM Cognos Controller · IBM Controller)
- [CVE-2024-28780](https://cve.now/CVE-2024-28780.md): IBM Cognos Controller information disclosure (CVSS 5.9, IBM Cognos Controller · IBM Controller)
- [CVE-2024-45081](https://cve.now/CVE-2024-45081.md): IBM Cognos Controller incorrect authorization (CVSS 6.5, IBM Cognos Controller · IBM Controller)
- [CVE-2025-1465](https://cve.now/CVE-2025-1465.md): lmxcms Maintenance db.inc.php code injection (CVSS 2.1, lmxcms)
- [CVE-2024-45084](https://cve.now/CVE-2024-45084.md): IBM Cognos Controller CSV injection (CVSS 8.0, IBM Cognos Controller · IBM Controller)
- [CVE-2024-52902](https://cve.now/CVE-2024-52902.md): IBM Cognos Controller information disclosure (CVSS 8.8, IBM Cognos Controller · IBM Controller)
- [CVE-2025-1464](https://cve.now/CVE-2025-1464.md): Baiyi Cloud Asset Management System admin.house.collect.php sql injection (CVSS 6.9, Baiyi Cloud Asset Management System)
- [CVE-2024-13534](https://cve.now/CVE-2024-13534.md): Small Package Quotes – Worldwide Express Edition \<= 5.2.18 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology Small Package Quotes – Worldwide Express…)
- [CVE-2024-13533](https://cve.now/CVE-2024-13533.md): Small Package Quotes – USPS Edition \<= 1.3.5 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology Small Package Quotes – USPS Edition)
- [CVE-2024-13483](https://cve.now/CVE-2024-13483.md): LTL Freight Quotes – SAIA Edition \<= 2.2.10 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology LTL Freight Quotes – SAIA Edition)
- [CVE-2024-13491](https://cve.now/CVE-2024-13491.md): Small Package Quotes – For Customers of FedEx \<= 4.3.1 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology Small Package Quotes – For Customers of F…)
- [CVE-2024-13481](https://cve.now/CVE-2024-13481.md): LTL Freight Quotes – R+L Carriers Edition \<= 3.3.4 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology LTL Freight Quotes – R+L Carriers Edition)
- [CVE-2024-13485](https://cve.now/CVE-2024-13485.md): LTL Freight Quotes – ABF Freight Edition \<= 3.3.7 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology LTL Freight Quotes – ABF Freight Edition)
- [CVE-2024-13479](https://cve.now/CVE-2024-13479.md): LTL Freight Quotes – SEFL Edition \<= 3.2.4 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology LTL Freight Quotes – SEFL Edition)
- [CVE-2025-0968](https://cve.now/CVE-2025-0968.md): ElementsKit Elementor addons \<= 3.4.0 - Unauthenticated Information Exposure via get\_megamenu\_content Function (CVSS 5.3, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…)
- [CVE-2024-13478](https://cve.now/CVE-2024-13478.md): LTL Freight Quotes – TForce Edition \<= 3.6.4 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology LTL Freight Quotes – TForce Edition)
- [CVE-2025-0916](https://cve.now/CVE-2025-0916.md): YaySMTP 2.4.9 - 2.6.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, yaycommerce YaySMTP and Email Logs: Amazon SES, SendGrid, O…)
- [CVE-2025-1075](https://cve.now/CVE-2025-1075.md): LDAP credentials logged to Apache error log (CVSS 5.6, Checkmk)
- [CVE-2024-13489](https://cve.now/CVE-2024-13489.md): LTL Freight Quotes – Old Dominion Edition \<= 4.2.10 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology LTL Freight Quotes – Old Dominion Edition)
- [CVE-2025-1135](https://cve.now/CVE-2025-1135.md): SQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.php (CVSS 9.3, ChurchCRM)
- [CVE-2025-1134](https://cve.now/CVE-2025-1134.md): SQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.php (CVSS 9.3, ChurchCRM)
- [CVE-2025-1133](https://cve.now/CVE-2025-1133.md): SQL Injection in ChurchCRM EID Parameter via EditEventAttendees.php (CVSS 9.3, ChurchCRM)
- [CVE-2025-1132](https://cve.now/CVE-2025-1132.md): SQL Injection in ChurchCRM EN\_tyid Parameter via EditEventAttendees.php (CVSS 9.3, ChurchCRM)
- [CVE-2025-1007](https://cve.now/CVE-2025-1007.md): Improper Authorization in /user/namespace/{namespace}/details (CVSS 6.9, Eclipse Foundation OpenVSX)
- [CVE-2025-1024](https://cve.now/CVE-2025-1024.md): Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID Parameter (CVSS 8.4, ChurchCRM)
- [CVE-2024-13363](https://cve.now/CVE-2024-13363.md): Raptive Ads \<= 3.6.3 - Reflected Cross-Site Scripting (CVSS 6.1, Raptive Ads)
- [CVE-2024-13339](https://cve.now/CVE-2024-13339.md): DeBounce Email Validator \<= 5.8.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, DeBounce Email Validator)
- [CVE-2024-13364](https://cve.now/CVE-2024-13364.md): Raptive Ads \<= 3.6.3 - Missing Authorization to Unauthenticated Data/Settings Reset (CVSS 5.3, Raptive Ads)
- [CVE-2024-13336](https://cve.now/CVE-2024-13336.md): Disable Auto Updates \<= 1.4 - Cross-Site Request Forgery to Auto-update Disable (CVSS 4.3, exeebit Disable Auto Updates)
- [CVE-2024-13231](https://cve.now/CVE-2024-13231.md): WordPress Portfolio Builder – Portfolio Gallery \<= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Update (CVSS 5.3, portfoliohub WordPress Portfolio Builder – Portfolio Gallery)
- [CVE-2024-13679](https://cve.now/CVE-2024-13679.md): Widget BUY.BOX \<= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, simply4net Widget BUY.BOX)
- [CVE-2024-13405](https://cve.now/CVE-2024-13405.md): Apptivo Business Site CRM \<= 5.3 - Cross-Site Request Forgery to IP Address Block (CVSS 4.3, Apptivo Business Site)
- [CVE-2024-13592](https://cve.now/CVE-2024-13592.md): Team Builder For WPBakery Page Builder(Formerly Visual Composer) \<= 1.0 - Authenticated (Contributor+) Local File Inclusion (CVSS 7.5, labibahmed42 Team Builder For WPBakery Page Builder)
- [CVE-2024-13468](https://cve.now/CVE-2024-13468.md): Trash Duplicate and 301 Redirect \<= 1.9 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVSS 7.5, solwininfotech Trash Duplicate and 301 Redirect)
- [CVE-2024-13591](https://cve.now/CVE-2024-13591.md): Team Builder For WPBakery Page Builder(Formerly Visual Composer) \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, labibahmed42 Team Builder For WPBakery Page Builder)
- [CVE-2024-13736](https://cve.now/CVE-2024-13736.md): Pure Chat – Live Chat & More! \<= 2.4 - Reflected Cross-Site Scripting via purechatWidgetName Parameter (CVSS 6.1, pure-chat Pure Chat – Live Chat & More!)
- [CVE-2024-13657](https://cve.now/CVE-2024-13657.md): Store Locator Widget \<= 2025r1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, store-locator-pro Store Locator Widget)
- [CVE-2024-13676](https://cve.now/CVE-2024-13676.md): Categorized Gallery Plugin \<= 2.0 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, wamasoftware Categorized Gallery Plugin)
- [CVE-2024-11753](https://cve.now/CVE-2024-11753.md): UMich OIDC Login \<= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, umichitswebhosting UMich OIDC Login)
- [CVE-2024-11778](https://cve.now/CVE-2024-11778.md): CanadaHelps Embedded Donation \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, CanadaHelps Embedded Donation Form)
- [CVE-2024-11335](https://cve.now/CVE-2024-11335.md): UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included \<= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ultradevs UltraEmbed – Advanced Iframe Plugin For WordPress…)
- [CVE-2024-13462](https://cve.now/CVE-2024-13462.md): WP Wiki Tooltip \<= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, nida78 WP Wiki Tooltip)
- [CVE-2024-12339](https://cve.now/CVE-2024-12339.md): Digihood HTML Sitemap \<= 3.1.1 - Reflected Cross-Site Scripting via 'channel' (CVSS 6.1, Digihood HTML Sitemap)
- [CVE-2024-13660](https://cve.now/CVE-2024-13660.md): Responsive Flickr Slideshow \<= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, robertmsiaorg Responsive Flickr Slideshow)
- [CVE-2024-12069](https://cve.now/CVE-2024-12069.md): Lexicata \<= 1.0.16 - Reflected Cross-Site Scripting (CVSS 6.1, Lexicata)
- [CVE-2024-13674](https://cve.now/CVE-2024-13674.md): Cosmic Blocks (40+) Content Editor Blocks Collection \<= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, berginformatik Cosmic Blocks (40+) Content Editor Blocks Co…)
- [CVE-2024-13854](https://cve.now/CVE-2024-13854.md): Education Addon for Elementor \<= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu\_elementor\_template Shortcode (CVSS 4.3, nicheaddons Education Addon for Elementor)
- [CVE-2024-13711](https://cve.now/CVE-2024-13711.md): Pollin \<= 1.01.1 - Reflected Cross-Site Scripting (CVSS 6.1, binnyva Pollin)
- [CVE-2024-12522](https://cve.now/CVE-2024-12522.md): Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, yayforms Yay! Forms)
- [CVE-2024-13719](https://cve.now/CVE-2024-13719.md): PeproDev Ultimate Invoice \<= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure (CVSS 5.3, PeproDev Ultimate Invoice)
- [CVE-2024-13390](https://cve.now/CVE-2024-13390.md): ADFO – Custom data in admin dashboard \<= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, giuliopanda ADFO – Custom data in admin dashboard)
- [CVE-2024-13712](https://cve.now/CVE-2024-13712.md): Pollin \<= 1.01.1 - Authenticated (Admin+) SQL Injection (CVSS 4.9, binnyva Pollin)
- [CVE-2024-13589](https://cve.now/CVE-2024-13589.md): YouTube Playlists with Schema \<= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, johnnya23 YouTube Playlists with Schema)
- [CVE-2025-0865](https://cve.now/CVE-2025-0865.md): WP Media Category Management 2.0 - 2.3.3 - Cross-Site Request Forgery to Settings Update (CVSS 6.5, debaat WP Media Category Management)
- [CVE-2024-13663](https://cve.now/CVE-2024-13663.md): Coaching Staffs \<= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, markodonnell Coaching Staffs)
- [CVE-2025-0633](https://cve.now/CVE-2025-0633.md): Heap Overflow in iniparser.c (CVSS 5.1, iniparser)
- [CVE-2024-12173](https://cve.now/CVE-2024-12173.md): Master Slider \< 3.10.5 - Editor+ Stored XSS (CVSS 3.5, Master Slider)
- [CVE-2025-24841](https://cve.now/CVE-2025-24841.md): Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. (CVSS 5.4, Six Apart Movable Type)
- [CVE-2025-25054](https://cve.now/CVE-2025-25054.md): Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. (CVSS 6.1, Six Apart Movable Type)
- [CVE-2025-22888](https://cve.now/CVE-2025-22888.md): Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. (CVSS 5.4, Six Apart Movable Type)
- [CVE-2024-13799](https://cve.now/CVE-2024-13799.md): User Private Files – File Upload & Download Manager with Secure File Sharing \<= 2.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, deepakkite File Sharing & Download Manager – User Private F…)
- [CVE-2025-1065](https://cve.now/CVE-2025-1065.md): Visualizer: Tables and Charts Manager for WordPress \<= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From File (CVSS 6.4, themeisle Visualizer: Tables and Charts Manager for WordPre…)
- [CVE-2025-1441](https://cve.now/CVE-2025-1441.md): Royal Elementor Addons and Templates \<= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2025-22622](https://cve.now/CVE-2025-22622.md): Age Verification - Reflected cross-site scripting (XSS) (CVSS 4.3, Age Checker Age Verification)
- [CVE-2024-13443](https://cve.now/CVE-2024-13443.md): Easypromos Plugin \<= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, easypromosapp Easypromos Plugin)
- [CVE-2024-11582](https://cve.now/CVE-2024-11582.md): Subscribe2 – Form, Email Subscribers & Newsletters \<= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP Parameter (CVSS 7.2, wedevs Subscribe2 – Form, Email Subscribers & Newsletters)
- [CVE-2025-1448](https://cve.now/CVE-2025-1448.md): Synway SMG Gateway Management Software 9-12ping.php command injection (CVSS 6.9, Synway SMG Gateway Management Software)
- [CVE-2025-1447](https://cve.now/CVE-2025-1447.md): kasuganosoras Pigeon index.php server-side request forgery (CVSS 5.3, kasuganosoras Pigeon)
- [CVE-2020-10095](https://cve.now/CVE-2020-10095.md): Various Lexmark devices have CSRF that allows an attacker to modify the configuration of the device. (CVSS 8.1)
- [CVE-2020-13481](https://cve.now/CVE-2020-13481.md): Certain Lexmark products through 2020-05-25 allow XSS which allows an attacker to obtain session credentials and other sensitive information (CVSS 6.1)
- [CVE-2020-35546](https://cve.now/CVE-2020-35546.md): Lexmark MX6500 LW75.JD.P296 and previous devices have Incorrect Access Control via the access control settings. (CVSS 9.1)
- [CVE-2023-46271](https://cve.now/CVE-2023-46271.md): Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has a buffer overflow. (CVSS 9.8)
- [CVE-2023-46272](https://cve.now/CVE-2023-46272.md): Buffer Overflow vulnerability in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, allows an attacker to execute (CVSS 8.8)
- [CVE-2023-51293](https://cve.now/CVE-2023-51293.md): A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Event Booking Calendar v4.0 allows attackers to sen (CVSS 7.5)
- [CVE-2023-51296](https://cve.now/CVE-2023-51296.md): PHPJabbers Event Booking Calendar v4.0 is vulnerable to Cross-Site Scripting (XSS) in the "name, plugin\_sms\_api\_key, plugin\_sms\_country\_code (CVSS 6.1)
- [CVE-2023-51297](https://cve.now/CVE-2023-51297.md): A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount (CVSS 6.5)
- [CVE-2023-51298](https://cve.now/CVE-2023-51298.md): PHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. (CVSS 4.7)
- [CVE-2023-51299](https://cve.now/CVE-2023-51299.md): PHPJabbers Hotel Booking System v4.0 is vulnerable to HTML Injection in the "name, plugin\_sms\_api\_key, plugin\_sms\_country\_code, title, plugi (CVSS 6.1)
- [CVE-2023-51300](https://cve.now/CVE-2023-51300.md): PHPJabbers Hotel Booking System v4.0 is vulnerable to Cross-Site Scripting (XSS) vulnerabilities in the "name, plugin\_sms\_api\_key, plugin\_sm (CVSS 6.1)
- [CVE-2023-51301](https://cve.now/CVE-2023-51301.md): A lack of rate limiting in the "Login Section, Forgot Email" feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an exc (CVSS 7.5)
- [CVE-2023-51302](https://cve.now/CVE-2023-51302.md): PHPJabbers Hotel Booking System v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. (CVSS 8.8)
- [CVE-2023-51303](https://cve.now/CVE-2023-51303.md): PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple HTML Injection in the "lid, name, plugin\_sms\_api\_key, plugin\_sms\_country\_co (CVSS 6.1)
- [CVE-2023-51305](https://cve.now/CVE-2023-51305.md): PHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, plugin\_sms\_api\_key, plugin (CVSS 5.4)
- [CVE-2024-57261](https://cve.now/CVE-2024-57261.md): In barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related issue to CVE-2024-57258. (CVSS 7.1, Pengutronix barebox)
- [CVE-2024-57262](https://cve.now/CVE-2024-57262.md): In barebox before 2025.01.0, ext4fs\_read\_symlink has an integer overflow for zalloc (adding one to an le32 variable) via a crafted ext4 file (CVSS 7.1, Pengutronix barebox)
- [CVE-2025-25942](https://cve.now/CVE-2025-25942.md): An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the mp4fragment tool when processing invalid files. (CVSS 6.5)
- [CVE-2025-25943](https://cve.now/CVE-2025-25943.md): Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4\_Stz2Atom::AP4\_Stz2Atom com (CVSS 7.8)
- [CVE-2025-25944](https://cve.now/CVE-2025-25944.md): Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom.cpp, specifically i (CVSS 7.3)
- [CVE-2025-25945](https://cve.now/CVE-2025-25945.md): An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the Mp4Fragment.cpp and in AP4\_DescriptorFactory::C (CVSS 6.5)
- [CVE-2025-25946](https://cve.now/CVE-2025-25946.md): An issue in Bento4 v1.6.0-641 allows an attacker to cause a memory leak via Ap4Marlin.cpp and Ap4Processor.cpp, specifically in AP4\_MarlinIp (CVSS 5.5)
- [CVE-2025-25947](https://cve.now/CVE-2025-25947.md): An issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp, specifically in AP4\_AtomParent::RemoveChil (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.