# CVEs published 2025-02-24

118 CVEs were published on February 24, 2025: 13 critical, 24 high. Days are UTC.

- [CVE-2025-27144](https://cve.now/CVE-2025-27144.md): Go JOSE's Parsing Vulnerable to Denial of Service (CVSS 6.6, go-jose · github.com/go-jose/go-jose +3)
- [CVE-2025-27143](https://cve.now/CVE-2025-27143.md): Beter Auth has an Open Redirect via Scheme-Less Callback Parameter (CVSS 6.9, better-auth)
- [CVE-2025-27141](https://cve.now/CVE-2025-27141.md): Metabase Enterprise Edition allows cached questions to leak data to impersonated users (CVSS 4.8, metabase)
- [CVE-2025-27140](https://cve.now/CVE-2025-27140.md): WeGIA vulnerable to OS Command Injection at endpoint 'importar\_dump.php' parameter 'import' (RCE) (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-27137](https://cve.now/CVE-2025-27137.md): Dependency-Track vulnerable to local file inclusion via custom notification templates (CVSS 4.4, DependencyTrack dependency-track)
- [CVE-2025-26533](https://cve.now/CVE-2025-26533.md): SQL injection risk in course search module list filter (CVSS 8.1, Moodle Project moodle · moodle/moodle)
- [CVE-2025-26532](https://cve.now/CVE-2025-26532.md): Teachers can evade trusttext config when restoring glossary entries (CVSS 3.1, Moodle Project moodle · moodle/moodle)
- [CVE-2025-26531](https://cve.now/CVE-2025-26531.md): IDOR in badges allows disabling of arbitrary badges (CVSS 3.1, Moodle Project moodle · moodle/moodle)
- [CVE-2025-26530](https://cve.now/CVE-2025-26530.md): Reflected XSS via question bank filter (CVSS 8.3, Moodle Project moodle · moodle/moodle)
- [CVE-2025-26529](https://cve.now/CVE-2025-26529.md): Stored XSS risk in admin live log (CVSS 8.3, Moodle Project moodle · moodle/moodle)
- [CVE-2025-26528](https://cve.now/CVE-2025-26528.md): Stored XSS in ddimageortext question type (CVSS 3.4, Moodle Project moodle · moodle/moodle)
- [CVE-2025-26527](https://cve.now/CVE-2025-26527.md): Non-searchable tags can still be discovered on the tag search page and in the tags block (CVSS 5.3, Moodle Project moodle · moodle/moodle)
- [CVE-2025-26526](https://cve.now/CVE-2025-26526.md): Feedback response viewing and deletions did not respect Separate Groups mode (CVSS 6.5, Moodle Project moodle · moodle/moodle)
- [CVE-2025-26525](https://cve.now/CVE-2025-26525.md): Arbitrary file read risk through pdfTeX (CVSS 8.6, Moodle Project moodle · moodle/moodle)
- [CVE-2025-27133](https://cve.now/CVE-2025-27133.md): WeGIA has SQL Injection endpoint at 'dao/pet/adicionar\_tipo\_exame.php' parameter 'tipo\_exame' (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-27112](https://cve.now/CVE-2025-27112.md): Navidrome has authentication bypass in Subsonic API with non-existent username (CVSS 6.9, navidrome · github.com/navidrome/navidrome)
- [CVE-2025-22495](https://cve.now/CVE-2025-22495.md): An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. (CVSS 8.4, Eaton Network M2)
- [CVE-2025-27357](https://cve.now/CVE-2025-27357.md): WordPress Önceki Yazı Link Plugin \<= 1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Musa AVCI Önceki Yazı Link)
- [CVE-2025-27356](https://cve.now/CVE-2025-27356.md): WordPress Sticky Header On Scroll plugin \<= 1.0 - Broken Access Control vulnerability (CVSS 5.4, Hardik Sticky Header On Scroll)
- [CVE-2025-27355](https://cve.now/CVE-2025-27355.md): WordPress Woocommerce – Loi Hamon Plugin \<= 1.1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Nicolas GRILLET Woocommerce – Loi Hamon)
- [CVE-2025-27353](https://cve.now/CVE-2025-27353.md): WordPress Namaste! LMS Plugin \<= 2.6.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Bob Namaste! LMS)
- [CVE-2025-27352](https://cve.now/CVE-2025-27352.md): WordPress 无觅相关文章插件 plugin \<= 1.0.5.7 - CSRF to Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wumii team 无觅相关文章插件)
- [CVE-2025-27351](https://cve.now/CVE-2025-27351.md): WordPress Local Search SEO Contact Page plugin \<= 4.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ExpertBusinessSearch Local Search SEO Contact Page)
- [CVE-2025-27349](https://cve.now/CVE-2025-27349.md): WordPress Get Posts plugin \<= 0.6 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nurelm Get Posts)
- [CVE-2025-27348](https://cve.now/CVE-2025-27348.md): WordPress WP Social SEO Booster plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Daniel WP Social SEO Booster – Knowledge Graph Social Signa…)
- [CVE-2025-27347](https://cve.now/CVE-2025-27347.md): WordPress Direct Checkout Button for WooCommerce plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, techmix Direct Checkout Button for WooCommerce)
- [CVE-2025-27344](https://cve.now/CVE-2025-27344.md): WordPress Phee's LinkPreview Plugin \<= 1.6.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, filipstepanov Phee's LinkPreview)
- [CVE-2025-27342](https://cve.now/CVE-2025-27342.md): WordPress WooCommerce Recargo de Equivalencia Plugin \<= 1.6.24 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, josesan WooCommerce Recargo de Equivalencia)
- [CVE-2025-27341](https://cve.now/CVE-2025-27341.md): WordPress Reactive Mortgage Calculator plugin \<= 1.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, afzal\_du Reactive Mortgage Calculator)
- [CVE-2025-27340](https://cve.now/CVE-2025-27340.md): WordPress F12-Profiler Plugin \<= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Forge12 Interactive F12-Profiler)
- [CVE-2025-27339](https://cve.now/CVE-2025-27339.md): WordPress Minimum Password Strength Plugin \<= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Will Anderson Minimum Password Strength)
- [CVE-2025-27336](https://cve.now/CVE-2025-27336.md): WordPress Just Variables Plugin \<= 1.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Alex Prokopenko / JustCoded Just Variables)
- [CVE-2025-27335](https://cve.now/CVE-2025-27335.md): WordPress Auto Tag Links Plugin \<= 1.0.13 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Free plug in by SEO Roma Auto Tag Links)
- [CVE-2025-27332](https://cve.now/CVE-2025-27332.md): WordPress Smart Maintenance & Countdown Plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, gmnazmul Smart Maintenance & Countdown)
- [CVE-2025-27331](https://cve.now/CVE-2025-27331.md): WordPress WooCommerce Display Products by Tags plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sébastien Dumont WooCommerce Display Products by Tags)
- [CVE-2025-27330](https://cve.now/CVE-2025-27330.md): WordPress PlayerJS plugin \<= 2.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PlayerJS)
- [CVE-2025-27329](https://cve.now/CVE-2025-27329.md): WordPress EZ InLinkz linkup plugin \<= 0.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, EZ InLinkz linkup)
- [CVE-2025-27328](https://cve.now/CVE-2025-27328.md): WordPress WP-PostRatings Cheater Plugin \<= 1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, queeez WP-PostRatings Cheater)
- [CVE-2025-27327](https://cve.now/CVE-2025-27327.md): WordPress Live Streaming Video Player – by SRS Player plugin \<= 1.0.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Winlin Live Streaming Video Player – by SRS Player)
- [CVE-2025-26883](https://cve.now/CVE-2025-26883.md): WordPress Animated Text Block plugin \<= 1.0.7 - Broken Access Control vulnerability (CVSS 6.5, bPlugins Animated Text Block)
- [CVE-2025-27325](https://cve.now/CVE-2025-27325.md): WordPress Video.js HLS Player plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bruce Video.js HLS Player)
- [CVE-2025-27323](https://cve.now/CVE-2025-27323.md): WordPress WP About Author plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jon Bishop WP About Author)
- [CVE-2025-27321](https://cve.now/CVE-2025-27321.md): WordPress Blightly Explorer plugin \<= 2.3.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Blighty Blightly Explorer)
- [CVE-2025-27320](https://cve.now/CVE-2025-27320.md): WordPress Profile Widget Ninja plugin \<= 4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Pankaj Mondal Profile Widget Ninja)
- [CVE-2025-27318](https://cve.now/CVE-2025-27318.md): WordPress Simple Google Sitemap Plugin \<= 1.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ixiter Simple Google Sitemap)
- [CVE-2025-27317](https://cve.now/CVE-2025-27317.md): WordPress RAYS Grid Plugin \<= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, IT-RAYS RAYS Grid)
- [CVE-2025-27316](https://cve.now/CVE-2025-27316.md): WordPress JPG, PNG Compression and Optimization Plugin \<= 1.7.35 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, hosting.io JPG, PNG Compression and Optimization)
- [CVE-2025-27315](https://cve.now/CVE-2025-27315.md): WordPress All-In-One Cufon Plugin \<= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wptom All-In-One Cufon)
- [CVE-2025-27312](https://cve.now/CVE-2025-27312.md): WordPress WP Sitemap plugin \<= 1.0 - SQL Injection vulnerability (CVSS 8.5, Jenst WP Sitemap)
- [CVE-2025-27311](https://cve.now/CVE-2025-27311.md): WordPress Bulk Content Creator Plugin \<= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, luk3thomas Bulk Content Creator)
- [CVE-2025-27307](https://cve.now/CVE-2025-27307.md): WordPress Quotes llama plugin \<= 3.0.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, oooorgle Quotes llama)
- [CVE-2025-27306](https://cve.now/CVE-2025-27306.md): WordPress Pathomation plugin \<= 2.5.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Pathomation)
- [CVE-2025-27305](https://cve.now/CVE-2025-27305.md): WordPress Table of Contents Block plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Achal Jain Table of Contents Block)
- [CVE-2025-27304](https://cve.now/CVE-2025-27304.md): WordPress Contact Form 7 Star Rating with font Awesome plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, themelogger Contact Form 7 Star Rating with font Awesome)
- [CVE-2025-27303](https://cve.now/CVE-2025-27303.md): WordPress Contact Form 7 Star Rating plugin \<= 1.10 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, themelogger Contact Form 7 Star Rating)
- [CVE-2025-27301](https://cve.now/CVE-2025-27301.md): WordPress NHR Options Table Manager Plugin \<= 1.1.2 - Deserialization of untrusted data vulnerability (CVSS 7.2, Nazmul Hasan Robin NHR Options Table Manager)
- [CVE-2025-27300](https://cve.now/CVE-2025-27300.md): WordPress ADFO plugin \<= 1.9.1 - Deserialization of untrusted data vulnerability (CVSS 7.2, giuliopanda ADFO)
- [CVE-2025-27298](https://cve.now/CVE-2025-27298.md): WordPress WP Video Posts plugin \<= 3.5.1 - CSRF to Remote Code Execution (RCE) vulnerability (CVSS 8.3, cmstactics WP Video Posts)
- [CVE-2025-27297](https://cve.now/CVE-2025-27297.md): WordPress Bravo Search & Replace Plugin \<= 1.0 - SQL Injection vulnerability (CVSS 7.6, guelben Bravo Search & Replace)
- [CVE-2025-27296](https://cve.now/CVE-2025-27296.md): WordPress Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue Plugin \<= 1.5 - Settings Change vulnerability (CVSS 7.2, revenueflex Auto Ad Inserter – Increase Google Adsense and…)
- [CVE-2025-27294](https://cve.now/CVE-2025-27294.md): WordPress WP-Asambleas plugin \<= 2.85.0 - Arbitrary Shortcode Execution vulnerability (CVSS 4.8, platcom WP-Asambleas)
- [CVE-2025-27290](https://cve.now/CVE-2025-27290.md): WordPress Select Erima Zarinpal Donate Plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, seyyed-amir Erima Zarinpal Donate)
- [CVE-2025-27280](https://cve.now/CVE-2025-27280.md): WordPress Archive Page plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Alobaidi Archive Page)
- [CVE-2025-27277](https://cve.now/CVE-2025-27277.md): WordPress Add Linked Images To Gallery plugin \<= 1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, tiefpunkt Add Linked Images To Gallery)
- [CVE-2025-27276](https://cve.now/CVE-2025-27276.md): WordPress Photo Gallery ( Responsive ) plugin \<= 4.0 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, lizeipe Photo Gallery)
- [CVE-2025-27272](https://cve.now/CVE-2025-27272.md): WordPress VG PostCarousel plugin \<= 1.1 - Local File Inclusion vulnerability (CVSS 7.5, vinagecko VG PostCarousel)
- [CVE-2025-27266](https://cve.now/CVE-2025-27266.md): WordPress Hover Image Button plugin \<= 1.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ignacio Perez Hover Image Button)
- [CVE-2025-27265](https://cve.now/CVE-2025-27265.md): WordPress Google Maps for WordPress plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aaron D. Campbell Google Maps for WordPress)
- [CVE-2024-12918](https://cve.now/CVE-2024-12918.md): SQLi in Agito Computer's Health4All (CVSS 8.8, Agito Computer Health4All)
- [CVE-2024-12917](https://cve.now/CVE-2024-12917.md): Improper Access Control in Agito Computer's Health4All (CVSS 8.3, Agito Computer Health4All)
- [CVE-2024-12916](https://cve.now/CVE-2024-12916.md): SQLi in Agito Computer's Life4All (CVSS 8.8, Agito Computer Life4All)
- [CVE-2025-0545](https://cve.now/CVE-2025-0545.md): XSS in Tekrom Technology's T-Soft E-Commerce (CVSS 4.7, Tekrom Technology T-Soft E-Commerce)
- [CVE-2024-5174](https://cve.now/CVE-2024-5174.md): Broken Authentication in Gliffy (CVSS 5.3, Gliffy Online)
- [CVE-2025-1632](https://cve.now/CVE-2025-1632.md): libarchive bsdunzip.c list null pointer dereference (CVSS 4.8, libarchive)
- [CVE-2025-1488](https://cve.now/CVE-2025-1488.md): WPO365 | MICROSOFT 365 GRAPH MAILER \<= 3.2 - Open Redirect via 'redirect\_to' Parameter (CVSS 4.7, WPO365 | MICROSOFT 365 GRAPH MAILER)
- [CVE-2023-52926](https://cve.now/CVE-2023-52926.md): io\_uring/rw: split io\_read() into a helper (CVSS 7.8, Linux)
- [CVE-2025-0690](https://cve.now/CVE-2025-0690.md): Grub2: read: integer overflow may lead to out-of-bounds write (CVSS 6.1, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2025-20051](https://cve.now/CVE-2025-20051.md): Arbitrary file read via block duplication in Mattermost Boards (CVSS 9.9, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-24490](https://cve.now/CVE-2025-24490.md): SQL Injection in Mattermost Boards via board category ID reordering (CVSS 9.6, Mattermost)
- [CVE-2025-25279](https://cve.now/CVE-2025-25279.md): Arbitrary file read in Mattermost Boards via import & export board archive (CVSS 9.9, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-1412](https://cve.now/CVE-2025-1412.md): Session Persistence After User-to-Bot Conversion (CVSS 3.1, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-24526](https://cve.now/CVE-2025-24526.md): Channel export permitted on archived channel when viewing archived channels is disabled (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-13822](https://cve.now/CVE-2024-13822.md): Total Contest Lite \<= 2.8.1 - Reflected XSS (CVSS 6.1, Photo Contest | Competition | Video Contest)
- [CVE-2024-13605](https://cve.now/CVE-2024-13605.md): Form Maker by 10Web \< 1.15.33 - Admin+ Stored XSS (CVSS 4.8, Form Maker by 10Web)
- [CVE-2024-12308](https://cve.now/CVE-2024-12308.md): Logo Slider \< 4.6.0 - Contributor+ Stored XSS (CVSS 5.4, Logo Slider)
- [CVE-2025-1629](https://cve.now/CVE-2025-1629.md): Excitel Broadband Private my Excitel App One-Time Password excessive authentication (CVSS 5.1, Excitel Broadband Private my Excitel App)
- [CVE-2025-1618](https://cve.now/CVE-2025-1618.md): vTiger CRM index.php cross site scripting (CVSS 5.3, vTiger CRM)
- [CVE-2025-1617](https://cve.now/CVE-2025-1617.md): Netis WF2780 Wireless 2.4G Menu cross site scripting (CVSS 4.8, Netis WF2780)
- [CVE-2025-1616](https://cve.now/CVE-2025-1616.md): FiberHome AN5506-01A ONU GPON Diagnosis os command injection (CVSS 5.1, FiberHome AN5506-01A ONU GPON)
- [CVE-2025-1615](https://cve.now/CVE-2025-1615.md): FiberHome AN5506-01A ONU GPON NAT Submenu cross site scripting (CVSS 4.8, FiberHome AN5506-01A ONU GPON)
- [CVE-2025-1614](https://cve.now/CVE-2025-1614.md): FiberHome AN5506-01A ONU GPON Port Forwarding Submenu portForwardingCfg cross site scripting (CVSS 4.8, FiberHome AN5506-01A ONU GPON)
- [CVE-2025-1613](https://cve.now/CVE-2025-1613.md): FiberHome AN5506-01A ONU GPON URL Filtering Submenu URL\_filterCfg cross site scripting (CVSS 4.8, FiberHome AN5506-01A ONU GPON)
- [CVE-2025-1612](https://cve.now/CVE-2025-1612.md): Edimax BR-6288ACL wireless5g\_basic.asp cross site scripting (CVSS 5.1, Edimax BR-6288ACL)
- [CVE-2024-55898](https://cve.now/CVE-2024-55898.md): IBM i privilege escalation (CVSS 8.5, IBM i)
- [CVE-2025-1611](https://cve.now/CVE-2025-1611.md): ShopXO Template ThemeAdminService.php injection (CVSS 5.1, ShopXO)
- [CVE-2025-1610](https://cve.now/CVE-2025-1610.md): LB-LINK AC1900 Router set\_blacklist websGetVar os command injection (CVSS 5.3, LB-LINK AC1900 Router)
- [CVE-2025-1609](https://cve.now/CVE-2025-1609.md): LB-LINK AC1900 Router set\_cmd websGetVar os command injection (CVSS 5.3, LB-LINK AC1900 Router)
- [CVE-2025-1608](https://cve.now/CVE-2025-1608.md): LB-LINK AC1900 Router set\_manpwd websGetVar os command injection (CVSS 5.3, LB-LINK AC1900 Router)
- [CVE-2025-1607](https://cve.now/CVE-2025-1607.md): SourceCodester Best Employee Management System salary\_slip.php authorization (CVSS 5.3, SourceCodester Best Employee Management System)
- [CVE-2025-1606](https://cve.now/CVE-2025-1606.md): SourceCodester Best Employee Management System backups.php information disclosure (CVSS 5.3, SourceCodester Best Employee Management System)
- [CVE-2025-1599](https://cve.now/CVE-2025-1599.md): SourceCodester Best Church Management Software profile\_crud.php path traversal (CVSS 5.3, SourceCodester Best Church Management Software)
- [CVE-2024-53542](https://cve.now/CVE-2024-53542.md): Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. (CVSS 6.5)
- [CVE-2024-53543](https://cve.now/CVE-2024-53543.md): NovaCHRON Zeitsysteme GmbH & Co. (CVSS 5.4)
- [CVE-2024-53544](https://cve.now/CVE-2024-53544.md): NovaCHRON Zeitsysteme GmbH & Co. (CVSS 9.8)
- [CVE-2024-54820](https://cve.now/CVE-2024-54820.md): XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. (CVSS 9.8)
- [CVE-2024-56525](https://cve.now/CVE-2024-56525.md): In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can c (CVSS 9.8)
- [CVE-2024-56897](https://cve.now/CVE-2024-56897.md): Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. (CVSS 9.8)
- [CVE-2024-57026](https://cve.now/CVE-2024-57026.md): TawkTo Widget Version \<= 1.3.7 is vulnerable to Cross Site Scripting (XSS) due to processing user input in a way that allows JavaScript exec (CVSS 6.1)
- [CVE-2024-57608](https://cve.now/CVE-2024-57608.md): An issue in Via Browser 6.1.0 allows a a remote attacker to execute arbitrary code via the mark.via.Shell component. (CVSS 6.5)
- [CVE-2024-57685](https://cve.now/CVE-2024-57685.md): An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar file. (CVSS 5.3)
- [CVE-2025-22974](https://cve.now/CVE-2025-22974.md): SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter i (CVSS 9.8)
- [CVE-2025-23017](https://cve.now/CVE-2025-23017.md): WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the atta (CVSS 6.0, WorkOS Hosted AuthKit)
- [CVE-2025-25460](https://cve.now/CVE-2025-25460.md): A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. (CVSS 4.8)
- [CVE-2025-25513](https://cve.now/CVE-2025-25513.md): Seacms \<=13.3 is vulnerable to SQL Injection in admin\_members.php. (CVSS 9.8)
- [CVE-2025-26200](https://cve.now/CVE-2025-26200.md): SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor\_report\_day.php compone (CVSS 7.2)
- [CVE-2025-26201](https://cve.now/CVE-2025-26201.md): Credential disclosure vulnerability via the /staff route in GreaterWMS \<= 2.1.49 allows a remote unauthenticated attackers to bypass authent (CVSS 9.1)
- [CVE-2025-26803](https://cve.now/CVE-2025-26803.md): The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an inva (CVSS 5.3, Phusion Passenger · passenger)
- [CVE-2025-27364](https://cve.now/CVE-2025-27364.md): In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implant (CVSS 10.0, MITRE Caldera)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.