CVEs published February 21, 2025
81 CVEs were published on February 21, 2025: 2 critical, 17 high.
- Published
- 81
- Critical
- 2
- High
- 17
- Medium
- 54
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Eclipse Foundation ThreadX
- 3
- vyperlang vyper · vyper
- 3
- D-Link DAP-1320
- 2
- Eclipse Foundation Eclipse OMR
- 2
- IBM Security Verify Bridge Directory Sync
- 2
- iteachyou Dreamer CMS
- 2
- abseil-cpp
- 1
- Ajax Search Lite
- 1
- amothemo AMO Team Showcase
- 1
- apexws Pie Calendar – Events Calendar Made Simple
- 1
Critical 2
- CVE-2024-38657External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a rIvanti Connect Secure · Ivanti Policy Secure
- CVE-2025-26014A Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter.
High 17
- CVE-2025-27106Code injection in binance-trading-botchrisleekr binance-trading-bot
- CVE-2025-27109Lack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-jssolidjs solid · solid-js
- CVE-2025-27108Cross-site Scripting vulnerability due to improper use of string.replace in dom-expressionsryansolid dom-expressions · dom-expressions
- CVE-2025-25282Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflowinfiniflow ragflow
- CVE-2025-1403Qiskit SDK denial of serviceIBM Qiskit SDK · qiskit-terra +1
- CVE-2025-1539D-Link DAP-1320 storagein.pd-XXXXXX replace_special_char stack-based overflowD-Link DAP-1320
- CVE-2025-1538D-Link DAP-1320 api set_ws_action heap-based overflowD-Link DAP-1320
- CVE-2024-9150Code Injection in Wyn EnterpriseWyn Enterprise
- CVE-2025-1471Eclipse OMR: Buffer overflow vulnerabilityEclipse Foundation Eclipse OMR
- CVE-2024-13353Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Local File Inclusioncyberchimps Responsive Addons for Elementor – Free Elemento…
- CVE-2025-0726Eclipse ThreadX NetX Duo HTTP server denial of serviceEclipse Foundation ThreadX
- CVE-2024-11260Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameternetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2024-57176An issue in the shiroFilter function of White-Jotter project v0.2.2 allows attackers to execute a directory traversal and access sensitive e
- CVE-2025-25769Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /controller/UserController.java.
- CVE-2025-25876A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0.
- CVE-2025-26013An issue in Loggrove v.1.0 allows a remote attacker to obtain sensitive information via the read.py component.
- CVE-2025-26794Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.Exim
Medium, low and unrated 62
- CVE-2024-45674IBM Security Verify Bridge information disclosureIBM Security Verify Bridge Directory Sync
- CVE-2025-26622sqrt doesn't define rounding behavior in Vypervyperlang vyper · vyper
- CVE-2025-27104double eval in For List Iter in Vypervyperlang vyper · vyper
- CVE-2025-27105AugAssign evaluation order causing OOB write within the object in Vypervyperlang vyper · vyper
- CVE-2019-8900A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon Apple SecureROM
- CVE-2025-1555hzmanyun Education and Training System saveImage unrestricted uploadhzmanyun Education and Training System
- CVE-2025-1548iteachyou Dreamer CMS edit cross site scriptingiteachyou Dreamer CMS
- CVE-2024-45673IBM Security Verify Bridge information disclosureIBM Security Verify Bridge Directory Sync
- CVE-2025-1546BDCOM Behavior Management and Auditing System operate.mds log_operate_clear os command injectionBDCOM Behavior Management and Auditing System
- CVE-2025-1544dingfanzu CMS loadShopInfo.php sql injectiondingfanzu CMS
- CVE-2025-1543iteachyou Dreamer CMS ueditor-1.4.3.3 path traversaliteachyou Dreamer CMS
- CVE-2025-1537Harpia DiagSystem atualatendimento_jpeg.php sql injectionHarpia DiagSystem
- CVE-2025-1536Raisecom Multi-Service Intelligent Gateway Request Parameter vpn_template_style.php os command injectionRaisecom Multi-Service Intelligent Gateway
- CVE-2025-0838Heap Buffer overflow in Abseilabseil-cpp
- CVE-2024-10222SVG Support <= 2.5.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadbenbodhi SVG Support
- CVE-2020-6158Opera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack.Opera Mini for Android
- CVE-2025-1535Baiyi Cloud Asset Management System admin.ticket.close.php sql injectionBaiyi Cloud Asset Management System
- CVE-2024-13846Indeed Ultimate Learning Pro <= 3.9 - Authenticated (Administrator+) SQL Injection via post_id Parameterazzaroco Indeed Ultimate Learning Pro
- CVE-2025-1402Event Tickets and Registration <= 5.19.1.1 - Missing Authorization to Ticket Deletionstellarwp Event Tickets and Registration
- CVE-2024-13455igumbi Online Booking <= 1.40 - Authenticated (Contributor+) Stored Cross-Site Scriptingsmtm igumbi Online Booking
- CVE-2024-13713WPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injectionsaadiqbal WPExperts Square For GiveWP
- CVE-2025-1489WP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcodemarcelismus WP-Appbox
- CVE-2024-13900Head, Footer and Post Injections <= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environmentssatollo Head, Footer and Post Injections
- CVE-2025-1470Eclipse OMR: Null pointer dereference vulnerabilityEclipse Foundation Eclipse OMR
- CVE-2024-12452Ziggeo <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingoliverfriedmann Ziggeo
- CVE-2024-13648Maps for WP <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingicopydoc Maps for WP
- CVE-2024-12276Ultimate Member <= 2.9.2 - Authenticated SQL Injectionultimatemember Ultimate Member – User Profile, Registration…
- CVE-2024-13461Autoship Cloud for WooCommerce Subscription Products <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingpatternsinthecloud Autoship Cloud for WooCommerce Subscript…
- CVE-2025-1410Events Calendar Made Simple – Pie Calendar <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piecal Shortcodeapexws Pie Calendar – Events Calendar Made Simple
- CVE-2025-0727Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflowEclipse Foundation ThreadX
- CVE-2025-0728Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflowEclipse Foundation ThreadX
- CVE-2024-13585Ajax Search Lite < 4.12.5 - Admin+ Stored XSSAjax Search Lite
- CVE-2024-13314Carousel, Slider, Gallery by WP Carousel < 2.7.4 - Admin+ Stored XSSCarousel, Slider, Gallery by WP Carousel
- CVE-2024-137513D Photo Gallery <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scriptinglabibahmed42 3D Photo Gallery
- CVE-2024-13537C9 Blocks <= 1.7.7 - Unauthenticated Full Path Disclosurettoomey C9 Blocks
- CVE-2025-1406Newpost Catch <= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via npc Shortcodes56bouya Newpost Catch
- CVE-2025-1407AMO Team Showcase <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via amoteam_skills Shortcodeamothemo AMO Team Showcase
- CVE-2024-13672Mini Course Generator | Embed mini-courses and interactive content <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingminicoursegenerator Mini Course Generator | Embed mini-cour…
- CVE-2024-13379C9 Admin Dashboard <= 1.3.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadttoomey C9 Admin Dashboard
- CVE-2024-13818Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction <= 3.8.4 - Sensitive Information Exposure via Log Filesgenetechproducts Pie Register – User Registration, Profiles…
- CVE-2024-13883WPUpper Share Buttons <= 3.51 - Cross-Site Request Forgery to Custom CSS Updatevictorfreitas WPUpper Share Buttons
- CVE-2024-13235Pinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injectiondotonpaper Pinpoint Booking System –
- CVE-2024-13388TCBD Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingtcoder TCBD Tooltip
- CVE-2025-1001Medixant RadiAnt DICOM Viewer Improper Certificate ValidationMedixant RadiAnt DICOM Viewer
- CVE-2025-27100An authenticated user can crash lakeFS by exhausting server memorytreeverse lakeFS · github.com/treeverse/lakefs
- CVE-2020-19248SQL Injection vulnerability in PbootCMS 1.4.1 in parsing if statements in templates, resulting in a malicious user's ability to contaminate
- CVE-2024-55156An XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access sen
- CVE-2024-55159GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list.
- CVE-2025-25505Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the sub_452A4 function.
- CVE-2025-25507There is a RCE vulnerability in Tenda AC6 15.03.05.16_multi.
- CVE-2025-25510Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the get_parentControl_list_Info function.
- CVE-2025-25604Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua.
- CVE-2025-25605Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua.
- CVE-2025-25765MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do.
- CVE-2025-25766An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via upl
- CVE-2025-25767A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrari
- CVE-2025-25768MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.jav
- CVE-2025-25770Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /agency/AgencyUserController.java.
- CVE-2025-25772A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add A
- CVE-2025-25875A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0.
- CVE-2025-25877A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0.
- CVE-2025-25878A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0.