CVEs published February 20, 2025
116 CVEs were published on February 20, 2025: 17 critical, 27 high. 1 is now in CISA KEV.
- Published
- 116
- Critical
- 17
- High
- 27
- Medium
- 71
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 26
Most affected products
- IBM OpenPages with Watson
- 8
- Citrix Secure Access Client for Mac
- 2
- Dell RecoverPoint for VMs
- 2
- enituretechnology LTL Freight Quotes – GlobalTranz Edition
- 2
- webcodingplace Ultimate Classified Listings
- 2
- amauric WPMobile.App
- 1
- Arc53 DocsGPT · docsgpt
- 1
- ardatan graphql-mesh · @graphql-mesh/cli +1
- 1
- ardatan graphql-mesh · @graphql-mesh/runtime
- 1
- AutoQueryable
- 1
Critical 17
- CVE-2025-24893Remote code execution as guest via SolrSearchMacros request in xwikixwiki-platform · org.xwiki.platform:xwiki-platform-search-s…
- CVE-2025-1265Elseta Vinci Protocol Analyzer OS Command InjectionElseta Vinci Protocol Analyzer
- CVE-2025-27096SQL Injection endpoint 'html/personalizacao_upload.php' parameter 'id_campo' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-20059PingAM Java Policy Agent path traversalPing Identity PingAM Java Policy Agent
- CVE-2025-0868Remote Code Execution in DocsGPTArc53 DocsGPT · docsgpt
- CVE-2024-13789Ravpage <= 2.31 - PHP Object Injectionmatiskiba ravpage
- CVE-2024-54756A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code
- CVE-2024-57401SQL Injection vulnerability in Uniclare Student portal v.2 and before allows a remote attacker to execute arbitrary code via the Forgot Pass
- CVE-2025-25662Tenda O4 V3.0 V1.0.0.10(2936) is vulnerable to Buffer Overflow in the function SafeSetMacFilter of the file /goform/setMacFilterList via the
- CVE-2025-25663A vulnerability was found in Tenda AC8V4 V16.03.34.06.
- CVE-2025-25664Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_49E098 function.
- CVE-2025-25667Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the urls parameter in the function get_parentControl_list_Info.
- CVE-2025-25668Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_47D878 function.
- CVE-2025-25674Tenda AC10 V1.0 V15.03.06.23 is vulnerable to Buffer Overflow in form_fast_setting_wifi_set via the parameter ssid.
- CVE-2025-25675Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function.
- CVE-2025-25676Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function.
- CVE-2025-25678Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.
High 27
- CVE-2025-27088Reflected Cross-site Scripting (XSS) in template implementation in oxyno-zeta/s3-proxyoxyno-zeta s3-proxy · github.com/oxyno-zeta/s3-proxy/cmd… +1
- CVE-2025-0352Rapid Response Monitoring My Security Account App Authorization Bypass Through User-Controlled KeyRapid Response Monitoring My Security Account App API
- CVE-2025-26618SSH SFTP packet size not verified properly in Erlang OTPerlang otp
- CVE-2025-27091OpenH264 Decoding Functions Heap Overflow Vulnerabilitycisco openh264
- CVE-2025-0161IBM Security Verify Access Appliance code injectionIBM Security Verify Access
- CVE-2025-1039Lenix Elementor Leads addon <= 1.8.2 - Unauthenticated Stored Cross-Site Scripting via URL Form Fieldyonifre Lenix Leads Collector
- CVE-2024-49781IBM OpenPages XML external entity injectionIBM OpenPages with Watson
- CVE-2024-13792WooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via idsEx-Themes WooCommerce Food - Restaurant Menu & Food ordering
- CVE-2024-13476LTL Freight Quotes – GlobalTranz Edition <= 2.3.11 - Unauthenticated SQL Injectionenituretechnology LTL Freight Quotes – GlobalTranz Edition
- CVE-2024-13753Ultimate Classified Listings <= 1.5 - Cross-Site Request Forgery to Account Takeoverwebcodingplace Ultimate Classified Listings
- CVE-2024-13888WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameteramauric WPMobile.App
- CVE-2025-26856Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE aI-O DATA DEVICE UD-LT2
- CVE-2025-1492Uncontrolled Recursion in WiresharkWireshark Foundation Wireshark
- CVE-2025-1293HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication BypassHashiCorp Tooling · github.com/hashicorp-forge/hermes
- CVE-2023-51311PHPJabbers Car Park Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
- CVE-2023-51313PHPJabbers Restaurant Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
- CVE-2023-51314A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Restaurant Booking System v3.0 allows attackers to
- CVE-2023-51316A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Bus Reservation System v1.1 allows attackers to send an excessive amo
- CVE-2023-51319PHPJabbers Bus Reservation System v1.1 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
- CVE-2023-51333PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
- CVE-2023-51336PHPJabbers Meeting Room Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
- CVE-2024-46933An issue was discovered in Atos Eviden BullSequana XH2140 BMC before C4EM-125: OMF_C4E 101.05.0014.
- CVE-2024-57716An issue in trenoncourt AutoQueryable v.1.7.0 allows a remote attacker to obtain sensitive information via the Unselectable function.AutoQueryable
- CVE-2025-22973An issue in QiboSoft QiboCMS X1.0 allows a remote attacker to obtain sensitive information via the http_curl() function in the '/application
- CVE-2025-25679Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function.
- CVE-2025-26304A memory leak has been identified in the parseSWF_EXPORTASSETS function in util/parser.c of libming v0.4.8.
- CVE-2025-26305A memory leak has been identified in the parseSWF_SOUNDINFO function in util/parser.c of libming v0.4.8, which allows attackers to cause a d
Medium, low and unrated 72
- CVE-2025-27097Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operationardatan graphql-mesh · @graphql-mesh/runtime
- CVE-2025-27098Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler in graphql-meshardatan graphql-mesh · @graphql-mesh/cli +1
- CVE-2025-25299Cross-site scripting (XSS) in the real-time collaboration packageckeditor5 · @ckeditor/ckeditor5-real-time-collaboration +1
- CVE-2024-7141CSRF in GliffyGliffy Online
- CVE-2025-21105Dell RecoverPoint for Virtual Machines 6.0.X contains a command execution vulnerability.Dell RecoverPoint for VMs
- CVE-2024-49337IBM OpenPages HTML injectionIBM OpenPages with Watson
- CVE-2024-49344IBM OpenPages session fixationIBM OpenPages with Watson
- CVE-2024-49779IBM OpenPages cross-site request forgeryIBM OpenPages with Watson
- CVE-2025-21106Dell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability.Dell RecoverPoint for VMs
- CVE-2025-1043Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcodeawsmin Embed Any Document – Embed PDF, Word, PowerPoint and…
- CVE-2025-1328Typed JS: A typewriter style animation <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via typespeed Parametermrlegend1235 Typed JS: A typewriter style animation
- CVE-2024-13802Bandsintown Events <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingkwestion505 Bandsintown Events
- CVE-2024-13855Prime Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcodenilambar Prime Addons for Elementor
- CVE-2025-0866Legoeso PDF Manager <= 1.2.2 - Authenticated (Author+) SQL Injection via checkedVals Parametertorviswesley Legoeso PDF Manager
- CVE-2024-13748Ultimate Classified Listings <= 1.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Title Parameterwebcodingplace Ultimate Classified Listings
- CVE-2024-13849Cookie Notice Bar <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scriptingdcurasi Cookie Notice Bar
- CVE-2024-6432Content Blocks (Custom Post Widget) <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parametervanderwijk Content Blocks
- CVE-2024-13520Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.9 - Missing Authorization to Unauthenticated Price, Date, and Note Updatescodemenschen Gift Cards (Gift Vouchers and Packages)
- CVE-2025-1483LTL Freight Quotes – GlobalTranz Edition <= 2.3.12 - Missing Authorization to Unauthenticated Settings Updateenituretechnology LTL Freight Quotes – GlobalTranz Edition
- CVE-2025-0897Modal Window <= 6.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcodewpcalc Modal Window – create popup modal window
- CVE-2025-1064Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcodexootix Login & Register Customizer – Popup | Slider | Inlin…
- CVE-2024-13155Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero Widgetunitecms Unlimited Elements For Elementor
- CVE-2024-13445Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingelemntor Elementor Website Builder – more than just a page…
- CVE-2024-49780IBM OpenPages path traversalIBM OpenPages with Watson
- CVE-2024-49782IBM OpenPages improper certificate validationIBM OpenPages with Watson
- CVE-2024-43196IBM OpenPages data manipulationIBM OpenPages with Watson
- CVE-2024-49355IBM OpenPages log manipulationIBM OpenPages with Watson
- CVE-2025-1223An attacker can gain application privileges in order to perform limited modification and/or read arbitrary dataCitrix Secure Access Client for Mac
- CVE-2025-1222An attacker can gain application privileges in order to perform limited modification and/or read arbitrary dataCitrix Secure Access Client for Mac
- CVE-2023-51306PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, title" parameters.
- CVE-2023-51308PHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code,
- CVE-2023-51309A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to send an excessive amo
- CVE-2023-51310A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to se
- CVE-2023-51312PHPJabbers Restaurant Booking System v3.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Reservations menu, Schedule section date
- CVE-2023-51315PHPJabbers Restaurant Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "seat_name, plugin_sms_api_key,
- CVE-2023-51317PHPJabbers Restaurant Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code
- CVE-2023-51318PHPJabbers Bus Reservation System v1.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters.
- CVE-2023-51320PHPJabbers Night Club Booking Software v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
- CVE-2023-51321A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Night Club Booking Software v1.0 allows attackers to send an excessiv
- CVE-2023-51323A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Shared Asset Booking System v1.0 allows attackers to send an excessiv
- CVE-2023-51324PHPJabbers Shared Asset Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
- CVE-2023-51325PHPJabbers Shared Asset Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters.
- CVE-2023-51326A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessive
- CVE-2023-51327A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessive
- CVE-2023-51330PHPJabbers Cinema Booking System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Now Showing menu "date" parameter.
- CVE-2023-51331PHPJabbers Cleaning Business Software v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
- CVE-2023-51332A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Meeting Room Booking System v1.0 allows attackers to send an excessiv
- CVE-2023-51334A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cinema Booking System v1.0 allows attackers to send an excessive amou
- CVE-2023-51335PHPJabbers Cinema Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters.
- CVE-2023-51337PHPJabbers Event Ticketing System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in "lid" parameter in index.
- CVE-2023-51338PHPJabbers Meeting Room Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters of&n
- CVE-2023-51339A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Event Ticketing System v1.0 allows attackers to send an excessive amo
- CVE-2024-54958Nagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page.
- CVE-2024-54959Nagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-
- CVE-2024-54960A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History
- CVE-2024-54961Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the
- CVE-2024-55457MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService.
- CVE-2025-23020An issue was discovered in Kwik before 0.10.1.ptrd Kwik · tech.kwik:kwik
- CVE-2025-24946The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a consideprivateoctopus picoquic
- CVE-2025-24947A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attalitespeedtech LSQUIC
- CVE-2025-25957Cross Site Scripting vulnerabilities in Xunruicms v.4.6.3 and before allows a remote attacker to escalate privileges via a crafted script.
- CVE-2025-25958Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via a crafted script.
- CVE-2025-25960Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member
- CVE-2025-25968DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability.
- CVE-2025-25973A stored Cross Site Scripting vulnerability in the "related recommendations" feature in Ppress v.0.0.9 allows a remote attacker to execute a
- CVE-2025-26306A memory leak has been identified in the readSizedString function in util/read.c of libming v0.4.8, which allows attackers to cause a denial
- CVE-2025-26307A memory leak has been identified in the parseSWF_IMPORTASSETS2 function in util/parser.c of libming v0.4.8, which allows attackers to cause
- CVE-2025-26308A memory leak has been identified in the parseSWF_FILTERLIST function in util/parser.c of libming v0.4.8, which allows attackers to cause a
- CVE-2025-26309A memory leak has been identified in the parseSWF_DEFINESCENEANDFRAMEDATA function in util/parser.c of libming v0.4.8, which allows attacker
- CVE-2025-26310Multiple memory leaks have been identified in the ABC file parsing functions (parseABC_CONSTANT_POOL and `parseABC_FILE) in util/parser.c of
- CVE-2025-26311Multiple memory leaks have been identified in the clip actions parsing functions (parseSWF_CLIPACTIONS and parseSWF_CLIPACTIONRECORD) in uti
- CVE-2025-27218Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserializa