# CVEs published 2025-02-20

116 CVEs were published on February 20, 2025: 17 critical, 27 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-27088](https://cve.now/CVE-2025-27088.md): Reflected Cross-site Scripting (XSS) in template implementation in oxyno-zeta/s3-proxy (CVSS 8.4, oxyno-zeta s3-proxy · github.com/oxyno-zeta/s3-proxy/cmd… +1)
- [CVE-2025-27097](https://cve.now/CVE-2025-27097.md): Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation (CVSS 5.1, ardatan graphql-mesh · @graphql-mesh/runtime)
- [CVE-2025-27098](https://cve.now/CVE-2025-27098.md): Unwanted access to the entire file system vulnerability due to a missing check in \`staticFiles\` HTTP handler in graphql-mesh (CVSS 5.8, ardatan graphql-mesh · @graphql-mesh/cli +1)
- [CVE-2025-25299](https://cve.now/CVE-2025-25299.md): Cross-site scripting (XSS) in the real-time collaboration package (CVSS 2.3, ckeditor5 · @ckeditor/ckeditor5-real-time-collaboration +1)
- [CVE-2025-24893](https://cve.now/CVE-2025-24893.md): Remote code execution as guest via SolrSearchMacros request in xwiki (CVSS 9.8, KEV, xwiki-platform · org.xwiki.platform:xwiki-platform-search-s…)
- [CVE-2025-0352](https://cve.now/CVE-2025-0352.md): Rapid Response Monitoring My Security Account App Authorization Bypass Through User-Controlled Key (CVSS 7.5, Rapid Response Monitoring My Security Account App API)
- [CVE-2025-1265](https://cve.now/CVE-2025-1265.md): Elseta Vinci Protocol Analyzer OS Command Injection (CVSS 9.9, Elseta Vinci Protocol Analyzer)
- [CVE-2025-27096](https://cve.now/CVE-2025-27096.md): SQL Injection endpoint 'html/personalizacao\_upload.php' parameter 'id\_campo' in WeGIA (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-26618](https://cve.now/CVE-2025-26618.md): SSH SFTP packet size not verified properly in Erlang OTP (CVSS 7.0, erlang otp)
- [CVE-2024-7141](https://cve.now/CVE-2024-7141.md): CSRF in Gliffy (CVSS 5.9, Gliffy Online)
- [CVE-2025-27091](https://cve.now/CVE-2025-27091.md): OpenH264 Decoding Functions Heap Overflow Vulnerability (CVSS 8.6, cisco openh264)
- [CVE-2025-0161](https://cve.now/CVE-2025-0161.md): IBM Security Verify Access Appliance code injection (CVSS 7.8, IBM Security Verify Access)
- [CVE-2025-20059](https://cve.now/CVE-2025-20059.md): PingAM Java Policy Agent path traversal (CVSS 9.2, Ping Identity PingAM Java Policy Agent)
- [CVE-2025-1039](https://cve.now/CVE-2025-1039.md): Lenix Elementor Leads addon \<= 1.8.2 - Unauthenticated Stored Cross-Site Scripting via URL Form Field (CVSS 7.2, yonifre Lenix Leads Collector)
- [CVE-2025-21105](https://cve.now/CVE-2025-21105.md): Dell RecoverPoint for Virtual Machines 6.0.X contains a command execution vulnerability. (CVSS 6.6, Dell RecoverPoint for VMs)
- [CVE-2024-49337](https://cve.now/CVE-2024-49337.md): IBM OpenPages HTML injection (CVSS 5.4, IBM OpenPages with Watson)
- [CVE-2024-49344](https://cve.now/CVE-2024-49344.md): IBM OpenPages session fixation (CVSS 4.3, IBM OpenPages with Watson)
- [CVE-2024-49779](https://cve.now/CVE-2024-49779.md): IBM OpenPages cross-site request forgery (CVSS 4.3, IBM OpenPages with Watson)
- [CVE-2024-49781](https://cve.now/CVE-2024-49781.md): IBM OpenPages XML external entity injection (CVSS 7.1, IBM OpenPages with Watson)
- [CVE-2025-21106](https://cve.now/CVE-2025-21106.md): Dell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability. (CVSS 5.5, Dell RecoverPoint for VMs)
- [CVE-2025-0868](https://cve.now/CVE-2025-0868.md): Remote Code Execution in DocsGPT (CVSS 9.3, Arc53 DocsGPT · docsgpt)
- [CVE-2025-1043](https://cve.now/CVE-2025-1043.md): Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files \<= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode (CVSS 6.4, awsmin Embed Any Document – Embed PDF, Word, PowerPoint and…)
- [CVE-2025-1328](https://cve.now/CVE-2025-1328.md): Typed JS: A typewriter style animation \<= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via typespeed Parameter (CVSS 6.4, mrlegend1235 Typed JS: A typewriter style animation)
- [CVE-2024-13792](https://cve.now/CVE-2024-13792.md): WooCommerce Food - Restaurant Menu & Food ordering \<= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids (CVSS 7.3, Ex-Themes WooCommerce Food - Restaurant Menu & Food ordering)
- [CVE-2024-13802](https://cve.now/CVE-2024-13802.md): Bandsintown Events \<= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, kwestion505 Bandsintown Events)
- [CVE-2024-13855](https://cve.now/CVE-2024-13855.md): Prime Addons for Elementor \<= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae\_global\_block Shortcode (CVSS 4.3, nilambar Prime Addons for Elementor)
- [CVE-2024-13476](https://cve.now/CVE-2024-13476.md): LTL Freight Quotes – GlobalTranz Edition \<= 2.3.11 - Unauthenticated SQL Injection (CVSS 7.5, enituretechnology LTL Freight Quotes – GlobalTranz Edition)
- [CVE-2024-13753](https://cve.now/CVE-2024-13753.md): Ultimate Classified Listings \<= 1.5 - Cross-Site Request Forgery to Account Takeover (CVSS 8.1, webcodingplace Ultimate Classified Listings)
- [CVE-2025-0866](https://cve.now/CVE-2025-0866.md): Legoeso PDF Manager \<= 1.2.2 - Authenticated (Author+) SQL Injection via checkedVals Parameter (CVSS 6.5, torviswesley Legoeso PDF Manager)
- [CVE-2024-13789](https://cve.now/CVE-2024-13789.md): Ravpage \<= 2.31 - PHP Object Injection (CVSS 9.8, matiskiba ravpage)
- [CVE-2024-13748](https://cve.now/CVE-2024-13748.md): Ultimate Classified Listings \<= 1.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Title Parameter (CVSS 4.4, webcodingplace Ultimate Classified Listings)
- [CVE-2024-13849](https://cve.now/CVE-2024-13849.md): Cookie Notice Bar \<= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, dcurasi Cookie Notice Bar)
- [CVE-2024-6432](https://cve.now/CVE-2024-6432.md): Content Blocks (Custom Post Widget) \<= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter (CVSS 6.4, vanderwijk Content Blocks)
- [CVE-2024-13520](https://cve.now/CVE-2024-13520.md): Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) \<= 4.4.9 - Missing Authorization to Unauthenticated Price, Date, and Note Updates (CVSS 5.3, codemenschen Gift Cards (Gift Vouchers and Packages))
- [CVE-2025-1483](https://cve.now/CVE-2025-1483.md): LTL Freight Quotes – GlobalTranz Edition \<= 2.3.12 - Missing Authorization to Unauthenticated Settings Update (CVSS 5.3, enituretechnology LTL Freight Quotes – GlobalTranz Edition)
- [CVE-2025-0897](https://cve.now/CVE-2025-0897.md): Modal Window \<= 6.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcode (CVSS 6.4, wpcalc Modal Window – create popup modal window)
- [CVE-2025-1064](https://cve.now/CVE-2025-1064.md): Login/Signup Popup ( Inline Form + Woocommerce ) \<= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo\_el\_action Shortcode (CVSS 6.4, xootix Login & Register Customizer – Popup | Slider | Inlin…)
- [CVE-2024-13888](https://cve.now/CVE-2024-13888.md): WPMobile.App \<= 11.56 - Open Redirect via 'redirect' Parameter (CVSS 7.2, amauric WPMobile.App)
- [CVE-2024-13155](https://cve.now/CVE-2024-13155.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero Widget (CVSS 6.4, unitecms Unlimited Elements For Elementor)
- [CVE-2025-26856](https://cve.now/CVE-2025-26856.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008\_SE a (CVSS 7.2, I-O DATA DEVICE UD-LT2)
- [CVE-2024-13445](https://cve.now/CVE-2024-13445.md): Elementor Website Builder – More Than Just a Page Builder \<= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, elemntor Elementor Website Builder – more than just a page…)
- [CVE-2024-49780](https://cve.now/CVE-2024-49780.md): IBM OpenPages path traversal (CVSS 5.3, IBM OpenPages with Watson)
- [CVE-2024-49782](https://cve.now/CVE-2024-49782.md): IBM OpenPages improper certificate validation (CVSS 6.8, IBM OpenPages with Watson)
- [CVE-2024-43196](https://cve.now/CVE-2024-43196.md): IBM OpenPages data manipulation (CVSS 4.3, IBM OpenPages with Watson)
- [CVE-2024-49355](https://cve.now/CVE-2024-49355.md): IBM OpenPages log manipulation (CVSS 5.3, IBM OpenPages with Watson)
- [CVE-2025-1492](https://cve.now/CVE-2025-1492.md): Uncontrolled Recursion in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2025-1293](https://cve.now/CVE-2025-1293.md): HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass (CVSS 8.2, HashiCorp Tooling · github.com/hashicorp-forge/hermes)
- [CVE-2025-1223](https://cve.now/CVE-2025-1223.md): An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data (CVSS 5.8, Citrix Secure Access Client for Mac)
- [CVE-2025-1222](https://cve.now/CVE-2025-1222.md): An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data (CVSS 5.8, Citrix Secure Access Client for Mac)
- [CVE-2023-51306](https://cve.now/CVE-2023-51306.md): PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, title" parameters. (CVSS 5.4)
- [CVE-2023-51308](https://cve.now/CVE-2023-51308.md): PHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, plugin\_sms\_api\_key, plugin\_sms\_country\_code, (CVSS 6.1)
- [CVE-2023-51309](https://cve.now/CVE-2023-51309.md): A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to send an excessive amo (CVSS 4.3)
- [CVE-2023-51310](https://cve.now/CVE-2023-51310.md): A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to se (CVSS 4.3)
- [CVE-2023-51311](https://cve.now/CVE-2023-51311.md): PHPJabbers Car Park Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. (CVSS 8.8)
- [CVE-2023-51312](https://cve.now/CVE-2023-51312.md): PHPJabbers Restaurant Booking System v3.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Reservations menu, Schedule section date (CVSS 5.4)
- [CVE-2023-51313](https://cve.now/CVE-2023-51313.md): PHPJabbers Restaurant Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. (CVSS 8.8)
- [CVE-2023-51314](https://cve.now/CVE-2023-51314.md): A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Restaurant Booking System v3.0 allows attackers to (CVSS 7.5)
- [CVE-2023-51315](https://cve.now/CVE-2023-51315.md): PHPJabbers Restaurant Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "seat\_name, plugin\_sms\_api\_key, (CVSS 5.4)
- [CVE-2023-51316](https://cve.now/CVE-2023-51316.md): A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Bus Reservation System v1.1 allows attackers to send an excessive amo (CVSS 7.5)
- [CVE-2023-51317](https://cve.now/CVE-2023-51317.md): PHPJabbers Restaurant Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, plugin\_sms\_api\_key, plugin\_sms\_country\_code (CVSS 6.5)
- [CVE-2023-51318](https://cve.now/CVE-2023-51318.md): PHPJabbers Bus Reservation System v1.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters. (CVSS 5.4)
- [CVE-2023-51319](https://cve.now/CVE-2023-51319.md): PHPJabbers Bus Reservation System v1.1 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. (CVSS 8.8)
- [CVE-2023-51320](https://cve.now/CVE-2023-51320.md): PHPJabbers Night Club Booking Software v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. (CVSS 5.3)
- [CVE-2023-51321](https://cve.now/CVE-2023-51321.md): A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Night Club Booking Software v1.0 allows attackers to send an excessiv (CVSS 6.5)
- [CVE-2023-51323](https://cve.now/CVE-2023-51323.md): A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Shared Asset Booking System v1.0 allows attackers to send an excessiv (CVSS 6.5)
- [CVE-2023-51324](https://cve.now/CVE-2023-51324.md): PHPJabbers Shared Asset Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. (CVSS 6.5)
- [CVE-2023-51325](https://cve.now/CVE-2023-51325.md): PHPJabbers Shared Asset Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters. (CVSS 5.4)
- [CVE-2023-51326](https://cve.now/CVE-2023-51326.md): A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessive (CVSS 6.5)
- [CVE-2023-51327](https://cve.now/CVE-2023-51327.md): A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessive (CVSS 6.5)
- [CVE-2023-51330](https://cve.now/CVE-2023-51330.md): PHPJabbers Cinema Booking System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Now Showing menu "date" parameter. (CVSS 5.4)
- [CVE-2023-51331](https://cve.now/CVE-2023-51331.md): PHPJabbers Cleaning Business Software v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. (CVSS 6.5)
- [CVE-2023-51332](https://cve.now/CVE-2023-51332.md): A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Meeting Room Booking System v1.0 allows attackers to send an excessiv (CVSS 4.3)
- [CVE-2023-51333](https://cve.now/CVE-2023-51333.md): PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. (CVSS 8.8)
- [CVE-2023-51334](https://cve.now/CVE-2023-51334.md): A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cinema Booking System v1.0 allows attackers to send an excessive amou (CVSS 5.3)
- [CVE-2023-51335](https://cve.now/CVE-2023-51335.md): PHPJabbers Cinema Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters. (CVSS 6.5)
- [CVE-2023-51336](https://cve.now/CVE-2023-51336.md): PHPJabbers Meeting Room Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. (CVSS 8.8)
- [CVE-2023-51337](https://cve.now/CVE-2023-51337.md): PHPJabbers Event Ticketing System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in "lid" parameter in index. (CVSS 5.4)
- [CVE-2023-51338](https://cve.now/CVE-2023-51338.md): PHPJabbers Meeting Room Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters of&n (CVSS 5.4)
- [CVE-2023-51339](https://cve.now/CVE-2023-51339.md): A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Event Ticketing System v1.0 allows attackers to send an excessive amo (CVSS 6.5)
- [CVE-2024-46933](https://cve.now/CVE-2024-46933.md): An issue was discovered in Atos Eviden BullSequana XH2140 BMC before C4EM-125: OMF\_C4E 101.05.0014. (CVSS 7.7)
- [CVE-2024-54756](https://cve.now/CVE-2024-54756.md): A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code (CVSS 9.8)
- [CVE-2024-54958](https://cve.now/CVE-2024-54958.md): Nagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. (CVSS 6.1)
- [CVE-2024-54959](https://cve.now/CVE-2024-54959.md): Nagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross- (CVSS 6.1)
- [CVE-2024-54960](https://cve.now/CVE-2024-54960.md): A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History (CVSS 6.5)
- [CVE-2024-54961](https://cve.now/CVE-2024-54961.md): Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the (CVSS 6.5)
- [CVE-2024-55457](https://cve.now/CVE-2024-55457.md): MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. (CVSS 6.5)
- [CVE-2024-57401](https://cve.now/CVE-2024-57401.md): SQL Injection vulnerability in Uniclare Student portal v.2 and before allows a remote attacker to execute arbitrary code via the Forgot Pass (CVSS 9.8)
- [CVE-2024-57716](https://cve.now/CVE-2024-57716.md): An issue in trenoncourt AutoQueryable v.1.7.0 allows a remote attacker to obtain sensitive information via the Unselectable function. (CVSS 7.5, AutoQueryable)
- [CVE-2025-22973](https://cve.now/CVE-2025-22973.md): An issue in QiboSoft QiboCMS X1.0 allows a remote attacker to obtain sensitive information via the http\_curl() function in the '/application (CVSS 7.5)
- [CVE-2025-23020](https://cve.now/CVE-2025-23020.md): An issue was discovered in Kwik before 0.10.1. (CVSS 5.3, ptrd Kwik · tech.kwik:kwik)
- [CVE-2025-24946](https://cve.now/CVE-2025-24946.md): The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a conside (CVSS 5.3, privateoctopus picoquic)
- [CVE-2025-24947](https://cve.now/CVE-2025-24947.md): A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote atta (CVSS 5.3, litespeedtech LSQUIC)
- [CVE-2025-25662](https://cve.now/CVE-2025-25662.md): Tenda O4 V3.0 V1.0.0.10(2936) is vulnerable to Buffer Overflow in the function SafeSetMacFilter of the file /goform/setMacFilterList via the (CVSS 9.8)
- [CVE-2025-25663](https://cve.now/CVE-2025-25663.md): A vulnerability was found in Tenda AC8V4 V16.03.34.06. (CVSS 9.8)
- [CVE-2025-25664](https://cve.now/CVE-2025-25664.md): Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub\_49E098 function. (CVSS 9.8)
- [CVE-2025-25667](https://cve.now/CVE-2025-25667.md): Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the urls parameter in the function get\_parentControl\_list\_Info. (CVSS 9.8)
- [CVE-2025-25668](https://cve.now/CVE-2025-25668.md): Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub\_47D878 function. (CVSS 9.8)
- [CVE-2025-25674](https://cve.now/CVE-2025-25674.md): Tenda AC10 V1.0 V15.03.06.23 is vulnerable to Buffer Overflow in form\_fast\_setting\_wifi\_set via the parameter ssid. (CVSS 9.8)
- [CVE-2025-25675](https://cve.now/CVE-2025-25675.md): Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. (CVSS 9.8)
- [CVE-2025-25676](https://cve.now/CVE-2025-25676.md): Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function. (CVSS 9.8)
- [CVE-2025-25678](https://cve.now/CVE-2025-25678.md): Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function. (CVSS 9.8)
- [CVE-2025-25679](https://cve.now/CVE-2025-25679.md): Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function. (CVSS 8.0)
- [CVE-2025-25957](https://cve.now/CVE-2025-25957.md): Cross Site Scripting vulnerabilities in Xunruicms v.4.6.3 and before allows a remote attacker to escalate privileges via a crafted script. (CVSS 6.1)
- [CVE-2025-25958](https://cve.now/CVE-2025-25958.md): Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via a crafted script. (CVSS 5.4)
- [CVE-2025-25960](https://cve.now/CVE-2025-25960.md): Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member (CVSS 6.1)
- [CVE-2025-25968](https://cve.now/CVE-2025-25968.md): DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. (CVSS 6.0)
- [CVE-2025-25973](https://cve.now/CVE-2025-25973.md): A stored Cross Site Scripting vulnerability in the "related recommendations" feature in Ppress v.0.0.9 allows a remote attacker to execute a (CVSS 6.5)
- [CVE-2025-26304](https://cve.now/CVE-2025-26304.md): A memory leak has been identified in the parseSWF\_EXPORTASSETS function in util/parser.c of libming v0.4.8. (CVSS 8.2)
- [CVE-2025-26305](https://cve.now/CVE-2025-26305.md): A memory leak has been identified in the parseSWF\_SOUNDINFO function in util/parser.c of libming v0.4.8, which allows attackers to cause a d (CVSS 8.2)
- [CVE-2025-26306](https://cve.now/CVE-2025-26306.md): A memory leak has been identified in the readSizedString function in util/read.c of libming v0.4.8, which allows attackers to cause a denial (CVSS 6.5)
- [CVE-2025-26307](https://cve.now/CVE-2025-26307.md): A memory leak has been identified in the parseSWF\_IMPORTASSETS2 function in util/parser.c of libming v0.4.8, which allows attackers to cause (CVSS 6.5)
- [CVE-2025-26308](https://cve.now/CVE-2025-26308.md): A memory leak has been identified in the parseSWF\_FILTERLIST function in util/parser.c of libming v0.4.8, which allows attackers to cause a (CVSS 6.5)
- [CVE-2025-26309](https://cve.now/CVE-2025-26309.md): A memory leak has been identified in the parseSWF\_DEFINESCENEANDFRAMEDATA function in util/parser.c of libming v0.4.8, which allows attacker (CVSS 6.5)
- [CVE-2025-26310](https://cve.now/CVE-2025-26310.md): Multiple memory leaks have been identified in the ABC file parsing functions (parseABC\_CONSTANT\_POOL and \`parseABC\_FILE) in util/parser.c of (CVSS 6.5)
- [CVE-2025-26311](https://cve.now/CVE-2025-26311.md): Multiple memory leaks have been identified in the clip actions parsing functions (parseSWF\_CLIPACTIONS and parseSWF\_CLIPACTIONRECORD) in uti (CVSS 6.5)
- [CVE-2025-27218](https://cve.now/CVE-2025-27218.md): Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserializa (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.