# CVEs published 2025-02-21

81 CVEs were published on February 21, 2025: 2 critical, 17 high. Days are UTC.

- [CVE-2024-45674](https://cve.now/CVE-2024-45674.md): IBM Security Verify Bridge information disclosure (CVSS 3.3, IBM Security Verify Bridge Directory Sync)
- [CVE-2025-26622](https://cve.now/CVE-2025-26622.md): sqrt doesn't define rounding behavior in Vyper (CVSS 2.3, vyperlang vyper · vyper)
- [CVE-2025-27104](https://cve.now/CVE-2025-27104.md): double eval in For List Iter in Vyper (CVSS 2.3, vyperlang vyper · vyper)
- [CVE-2025-27105](https://cve.now/CVE-2025-27105.md): AugAssign evaluation order causing OOB write within the object in Vyper (CVSS 2.3, vyperlang vyper · vyper)
- [CVE-2025-27106](https://cve.now/CVE-2025-27106.md): Code injection in binance-trading-bot (CVSS 7.7, chrisleekr binance-trading-bot)
- [CVE-2019-8900](https://cve.now/CVE-2019-8900.md): A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon (CVSS 6.8, Apple SecureROM)
- [CVE-2025-27109](https://cve.now/CVE-2025-27109.md): Lack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-js (CVSS 7.3, solidjs solid · solid-js)
- [CVE-2025-27108](https://cve.now/CVE-2025-27108.md): Cross-site Scripting vulnerability due to improper use of string.replace in dom-expressions (CVSS 7.3, ryansolid dom-expressions · dom-expressions)
- [CVE-2025-25282](https://cve.now/CVE-2025-25282.md): Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow (CVSS 8.1, infiniflow ragflow)
- [CVE-2025-1555](https://cve.now/CVE-2025-1555.md): hzmanyun Education and Training System saveImage unrestricted upload (CVSS 6.9, hzmanyun Education and Training System)
- [CVE-2025-1548](https://cve.now/CVE-2025-1548.md): iteachyou Dreamer CMS edit cross site scripting (CVSS 5.1, iteachyou Dreamer CMS)
- [CVE-2025-1403](https://cve.now/CVE-2025-1403.md): Qiskit SDK denial of service (CVSS 8.6, IBM Qiskit SDK · qiskit-terra +1)
- [CVE-2024-45673](https://cve.now/CVE-2024-45673.md): IBM Security Verify Bridge information disclosure (CVSS 5.5, IBM Security Verify Bridge Directory Sync)
- [CVE-2025-1546](https://cve.now/CVE-2025-1546.md): BDCOM Behavior Management and Auditing System operate.mds log\_operate\_clear os command injection (CVSS 6.9, BDCOM Behavior Management and Auditing System)
- [CVE-2025-1544](https://cve.now/CVE-2025-1544.md): dingfanzu CMS loadShopInfo.php sql injection (CVSS 5.3, dingfanzu CMS)
- [CVE-2025-1543](https://cve.now/CVE-2025-1543.md): iteachyou Dreamer CMS ueditor-1.4.3.3 path traversal (CVSS 5.3, iteachyou Dreamer CMS)
- [CVE-2025-1539](https://cve.now/CVE-2025-1539.md): D-Link DAP-1320 storagein.pd-XXXXXX replace\_special\_char stack-based overflow (CVSS 8.7, D-Link DAP-1320)
- [CVE-2025-1538](https://cve.now/CVE-2025-1538.md): D-Link DAP-1320 api set\_ws\_action heap-based overflow (CVSS 8.7, D-Link DAP-1320)
- [CVE-2025-1537](https://cve.now/CVE-2025-1537.md): Harpia DiagSystem atualatendimento\_jpeg.php sql injection (CVSS 5.3, Harpia DiagSystem)
- [CVE-2025-1536](https://cve.now/CVE-2025-1536.md): Raisecom Multi-Service Intelligent Gateway Request Parameter vpn\_template\_style.php os command injection (CVSS 6.9, Raisecom Multi-Service Intelligent Gateway)
- [CVE-2025-0838](https://cve.now/CVE-2025-0838.md): Heap Buffer overflow in Abseil (CVSS 5.9, abseil-cpp)
- [CVE-2024-10222](https://cve.now/CVE-2024-10222.md): SVG Support \<= 2.5.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, benbodhi SVG Support)
- [CVE-2020-6158](https://cve.now/CVE-2020-6158.md): Opera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. (CVSS 4.7, Opera Mini for Android)
- [CVE-2025-1535](https://cve.now/CVE-2025-1535.md): Baiyi Cloud Asset Management System admin.ticket.close.php sql injection (CVSS 6.9, Baiyi Cloud Asset Management System)
- [CVE-2024-9150](https://cve.now/CVE-2024-9150.md): Code Injection in Wyn Enterprise (CVSS 8.7, Wyn Enterprise)
- [CVE-2024-13846](https://cve.now/CVE-2024-13846.md): Indeed Ultimate Learning Pro \<= 3.9 - Authenticated (Administrator+) SQL Injection via post\_id Parameter (CVSS 4.9, azzaroco Indeed Ultimate Learning Pro)
- [CVE-2025-1402](https://cve.now/CVE-2025-1402.md): Event Tickets and Registration \<= 5.19.1.1 - Missing Authorization to Ticket Deletion (CVSS 5.3, stellarwp Event Tickets and Registration)
- [CVE-2024-13455](https://cve.now/CVE-2024-13455.md): igumbi Online Booking \<= 1.40 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, smtm igumbi Online Booking)
- [CVE-2024-13713](https://cve.now/CVE-2024-13713.md): WPExperts Square For GiveWP \<= 1.3.1 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, saadiqbal WPExperts Square For GiveWP)
- [CVE-2025-1489](https://cve.now/CVE-2025-1489.md): WP-Appbox \<= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode (CVSS 6.4, marcelismus WP-Appbox)
- [CVE-2024-13900](https://cve.now/CVE-2024-13900.md): Head, Footer and Post Injections \<= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments (CVSS 4.1, satollo Head, Footer and Post Injections)
- [CVE-2025-1471](https://cve.now/CVE-2025-1471.md): Eclipse OMR: Buffer overflow vulnerability (CVSS 7.1, Eclipse Foundation Eclipse OMR)
- [CVE-2025-1470](https://cve.now/CVE-2025-1470.md): Eclipse OMR: Null pointer dereference vulnerability (CVSS 5.1, Eclipse Foundation Eclipse OMR)
- [CVE-2024-12452](https://cve.now/CVE-2024-12452.md): Ziggeo \<= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, oliverfriedmann Ziggeo)
- [CVE-2024-13648](https://cve.now/CVE-2024-13648.md): Maps for WP \<= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, icopydoc Maps for WP)
- [CVE-2024-13353](https://cve.now/CVE-2024-13353.md): Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates \<= 1.6.4 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, cyberchimps Responsive Addons for Elementor – Free Elemento…)
- [CVE-2024-12276](https://cve.now/CVE-2024-12276.md): Ultimate Member \<= 2.9.2 - Authenticated SQL Injection (CVSS 5.3, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2024-13461](https://cve.now/CVE-2024-13461.md): Autoship Cloud for WooCommerce Subscription Products \<= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, patternsinthecloud Autoship Cloud for WooCommerce Subscript…)
- [CVE-2025-1410](https://cve.now/CVE-2025-1410.md): Events Calendar Made Simple – Pie Calendar \<= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piecal Shortcode (CVSS 6.4, apexws Pie Calendar – Events Calendar Made Simple)
- [CVE-2025-0727](https://cve.now/CVE-2025-0727.md): Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow (CVSS 5.3, Eclipse Foundation ThreadX)
- [CVE-2025-0728](https://cve.now/CVE-2025-0728.md): Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow (CVSS 5.3, Eclipse Foundation ThreadX)
- [CVE-2025-0726](https://cve.now/CVE-2025-0726.md): Eclipse ThreadX NetX Duo HTTP server denial of service (CVSS 7.1, Eclipse Foundation ThreadX)
- [CVE-2024-13585](https://cve.now/CVE-2024-13585.md): Ajax Search Lite \< 4.12.5 - Admin+ Stored XSS (CVSS 3.5, Ajax Search Lite)
- [CVE-2024-13314](https://cve.now/CVE-2024-13314.md): Carousel, Slider, Gallery by WP Carousel \< 2.7.4 - Admin+ Stored XSS (CVSS 3.5, Carousel, Slider, Gallery by WP Carousel)
- [CVE-2024-11260](https://cve.now/CVE-2024-11260.md): Events Manager – Calendar, Bookings, Tickets, and more! \<= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter (CVSS 7.5, netweblogic Events Manager – Calendar, Bookings, Tickets, a…)
- [CVE-2024-13751](https://cve.now/CVE-2024-13751.md): 3D Photo Gallery \<= 1.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, labibahmed42 3D Photo Gallery)
- [CVE-2024-13537](https://cve.now/CVE-2024-13537.md): C9 Blocks \<= 1.7.7 - Unauthenticated Full Path Disclosure (CVSS 5.3, ttoomey C9 Blocks)
- [CVE-2025-1406](https://cve.now/CVE-2025-1406.md): Newpost Catch \<= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via npc Shortcode (CVSS 6.4, s56bouya Newpost Catch)
- [CVE-2025-1407](https://cve.now/CVE-2025-1407.md): AMO Team Showcase \<= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via amoteam\_skills Shortcode (CVSS 6.4, amothemo AMO Team Showcase)
- [CVE-2024-13672](https://cve.now/CVE-2024-13672.md): Mini Course Generator | Embed mini-courses and interactive content \<= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, minicoursegenerator Mini Course Generator | Embed mini-cour…)
- [CVE-2024-13379](https://cve.now/CVE-2024-13379.md): C9 Admin Dashboard \<= 1.3.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, ttoomey C9 Admin Dashboard)
- [CVE-2024-13818](https://cve.now/CVE-2024-13818.md): Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction \<= 3.8.4 - Sensitive Information Exposure via Log Files (CVSS 5.3, genetechproducts Pie Register – User Registration, Profiles…)
- [CVE-2024-13883](https://cve.now/CVE-2024-13883.md): WPUpper Share Buttons \<= 3.51 - Cross-Site Request Forgery to Custom CSS Update (CVSS 4.3, victorfreitas WPUpper Share Buttons)
- [CVE-2024-13235](https://cve.now/CVE-2024-13235.md): Pinpoint Booking System – #1 WordPress Booking Plugin \<= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, dotonpaper Pinpoint Booking System –)
- [CVE-2024-13388](https://cve.now/CVE-2024-13388.md): TCBD Tooltip \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, tcoder TCBD Tooltip)
- [CVE-2024-38657](https://cve.now/CVE-2024-38657.md): External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a r (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2025-1001](https://cve.now/CVE-2025-1001.md): Medixant RadiAnt DICOM Viewer Improper Certificate Validation (CVSS 5.7, Medixant RadiAnt DICOM Viewer)
- [CVE-2025-27100](https://cve.now/CVE-2025-27100.md): An authenticated user can crash lakeFS by exhausting server memory (CVSS 6.5, treeverse lakeFS · github.com/treeverse/lakefs)
- [CVE-2020-19248](https://cve.now/CVE-2020-19248.md): SQL Injection vulnerability in PbootCMS 1.4.1 in parsing if statements in templates, resulting in a malicious user's ability to contaminate (CVSS 5.1)
- [CVE-2024-55156](https://cve.now/CVE-2024-55156.md): An XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access sen (CVSS 5.5)
- [CVE-2024-55159](https://cve.now/CVE-2024-55159.md): GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list. (CVSS 4.2)
- [CVE-2024-57176](https://cve.now/CVE-2024-57176.md): An issue in the shiroFilter function of White-Jotter project v0.2.2 allows attackers to execute a directory traversal and access sensitive e (CVSS 7.6)
- [CVE-2025-25505](https://cve.now/CVE-2025-25505.md): Tenda AC6 15.03.05.16\_multi is vulnerable to Buffer Overflow in the sub\_452A4 function. (CVSS 6.5)
- [CVE-2025-25507](https://cve.now/CVE-2025-25507.md): There is a RCE vulnerability in Tenda AC6 15.03.05.16\_multi. (CVSS 6.5)
- [CVE-2025-25510](https://cve.now/CVE-2025-25510.md): Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the get\_parentControl\_list\_Info function. (CVSS 6.5)
- [CVE-2025-25604](https://cve.now/CVE-2025-25604.md): Totolink X5000R V9.1.0u.6369\_B20230113 is vulnerable to command injection via the vif\_disable function in mtkwifi.lua. (CVSS 6.5)
- [CVE-2025-25605](https://cve.now/CVE-2025-25605.md): Totolink X5000R V9.1.0u.6369\_B20230113 is vulnerable to command injection via the apcli\_wps\_gen\_pincode function in mtkwifi.lua. (CVSS 6.5)
- [CVE-2025-25765](https://cve.now/CVE-2025-25765.md): MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do. (CVSS 4.0)
- [CVE-2025-25766](https://cve.now/CVE-2025-25766.md): An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via upl (CVSS 4.8)
- [CVE-2025-25767](https://cve.now/CVE-2025-25767.md): A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrari (CVSS 4.8)
- [CVE-2025-25768](https://cve.now/CVE-2025-25768.md): MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \\servlet\\DispatcherServlet.jav (CVSS 5.4)
- [CVE-2025-25769](https://cve.now/CVE-2025-25769.md): Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /controller/UserController.java. (CVSS 8.0)
- [CVE-2025-25770](https://cve.now/CVE-2025-25770.md): Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /agency/AgencyUserController.java. (CVSS 6.8)
- [CVE-2025-25772](https://cve.now/CVE-2025-25772.md): A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add A (CVSS 5.1)
- [CVE-2025-25875](https://cve.now/CVE-2025-25875.md): A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. (CVSS 6.4)
- [CVE-2025-25876](https://cve.now/CVE-2025-25876.md): A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. (CVSS 7.2)
- [CVE-2025-25877](https://cve.now/CVE-2025-25877.md): A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. (CVSS 3.8)
- [CVE-2025-25878](https://cve.now/CVE-2025-25878.md): A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. (CVSS 3.8)
- [CVE-2025-26013](https://cve.now/CVE-2025-26013.md): An issue in Loggrove v.1.0 allows a remote attacker to obtain sensitive information via the read.py component. (CVSS 8.2)
- [CVE-2025-26014](https://cve.now/CVE-2025-26014.md): A Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter. (CVSS 9.8)
- [CVE-2025-26794](https://cve.now/CVE-2025-26794.md): Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (CVSS 7.5, Exim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.