# CVEs published 2025-02-28

85 CVEs were published on February 28, 2025: 7 critical, 18 high. Days are UTC.

- [CVE-2024-1509](https://cve.now/CVE-2024-1509.md): Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100 (CVSS 7.6, Brocade ASCG)
- [CVE-2025-26466](https://cve.now/CVE-2025-26466.md): Openssh: denial-of-service in openssh (CVSS 5.9, OpenSSH · Red Hat Enterprise Linux +1)
- [CVE-2025-27414](https://cve.now/CVE-2025-27414.md): MinIO SFTP authentication bypass due to improperly trusted SSH key (CVSS 4.6, minio · github.com/minio/minio)
- [CVE-2025-27413](https://cve.now/CVE-2025-27413.md): PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json (CVSS 6.5, pwndoc)
- [CVE-2025-27410](https://cve.now/CVE-2025-27410.md): PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin (CVSS 6.5, pwndoc)
- [CVE-2025-0769](https://cve.now/CVE-2025-0769.md): PixelYourSite 10.1.1.1 - Insecure deserialization (CVSS 6.3, pixelyoursite)
- [CVE-2025-0160](https://cve.now/CVE-2025-0160.md): IBM FlashSystem code execution (CVSS 8.1, IBM Storage Virtualize)
- [CVE-2025-0159](https://cve.now/CVE-2025-0159.md): IBM FlashSystem authentication bypass (CVSS 9.1, IBM Storage Virtualize)
- [CVE-2025-1795](https://cve.now/CVE-2025-1795.md): Mishandling of comma during folding and unicode-encoding of email headers (CVSS 2.3, Python Software Foundation CPython)
- [CVE-2025-27408](https://cve.now/CVE-2025-27408.md): Manifest Uses a One-Way Hash without a Salt (CVSS 4.8, mnfst manifest · manifest)
- [CVE-2025-24316](https://cve.now/CVE-2025-24316.md): Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Exposure of Sensitive Information Due to Incompatible Policies (CVSS 5.3, Dario Health Dario Application Database and Internet-based…)
- [CVE-2025-24318](https://cve.now/CVE-2025-24318.md): Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' Flag (CVSS 6.8, Dario Health Dario Application Database and Internet-based…)
- [CVE-2025-20049](https://cve.now/CVE-2025-20049.md): Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cross-site Scripting (CVSS 5.8, Dario Health Dario Application Database and Internet-based…)
- [CVE-2025-24849](https://cve.now/CVE-2025-24849.md): Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cleartext Transmission of Sensitive Information (CVSS 7.1, Dario Health USB-C Blood Glucose Monitoring System Starter…)
- [CVE-2025-24843](https://cve.now/CVE-2025-24843.md): Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Storage of Sensitive Data in a Mechanism without Access Control (CVSS 5.1, Dario Health USB-C Blood Glucose Monitoring System Starter…)
- [CVE-2025-23405](https://cve.now/CVE-2025-23405.md): Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Improper Output Neutralization For Logs (CVSS 5.3, Dario Health USB-C Blood Glucose Monitoring System Starter…)
- [CVE-2025-20060](https://cve.now/CVE-2025-20060.md): Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Exposure of Private Personal Information to an Unauthorized Actor (CVSS 7.5, Dario Health USB-C Blood Glucose Monitoring System Starter…)
- [CVE-2025-0985](https://cve.now/CVE-2025-0985.md): IBM MQ information disclosure (CVSS 5.5, IBM MQ)
- [CVE-2024-54175](https://cve.now/CVE-2024-54175.md): IBM MQ denial of service (CVSS 5.5, IBM MQ)
- [CVE-2025-27400](https://cve.now/CVE-2025-27400.md): Magento vulnerable to stored XSS in theme config fields (CVSS 2.9, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2025-1776](https://cve.now/CVE-2025-1776.md): Cross-Site Scripting (XSS) vulnerability in Soteshop (CVSS 6.1, Soteshop)
- [CVE-2025-1749](https://cve.now/CVE-2025-1749.md): HTML injection vulnerability in OpenCart (CVSS 4.7, OpenCart)
- [CVE-2025-1748](https://cve.now/CVE-2025-1748.md): HTML injection vulnerability in OpenCart (CVSS 4.7, OpenCart)
- [CVE-2025-1747](https://cve.now/CVE-2025-1747.md): HTML injection vulnerability in OpenCart (CVSS 4.7, OpenCart)
- [CVE-2025-1746](https://cve.now/CVE-2025-1746.md): Cross-Site Scripting vulnerability in OpenCart (CVSS 6.1, OpenCart)
- [CVE-2025-1300](https://cve.now/CVE-2025-1300.md): Open redirect in CodeChecker web server (CVSS 6.1, Ericsson CodeChecker · codechecker)
- [CVE-2025-1319](https://cve.now/CVE-2025-1319.md): Site Mailer \<= 1.2.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, elemntor Site Mailer – SMTP Replacement, Email API Delivera…)
- [CVE-2025-22274](https://cve.now/CVE-2025-22274.md): HTML injection in CyberArk Endpoint Privilege Manager (CVSS 2.0, CyberArk Endpoint Privilege Manager)
- [CVE-2025-22273](https://cve.now/CVE-2025-22273.md): Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege Manager (CVSS 9.3, CyberArk Endpoint Privilege Manager)
- [CVE-2025-22272](https://cve.now/CVE-2025-22272.md): Self Reflected XSS in CyberArk Endpoint Privilege Manager (CVSS 2.1, CyberArk Endpoint Privilege Manager)
- [CVE-2025-22271](https://cve.now/CVE-2025-22271.md): IP Spoofing in CyberArk Endpoint Privilege Manager (CVSS 6.9, CyberArk Endpoint Privilege Manager)
- [CVE-2025-22270](https://cve.now/CVE-2025-22270.md): Stored XSS in CyberArk Endpoint Privilege Manager (CVSS 7.3, CyberArk Endpoint Privilege Manager)
- [CVE-2024-10860](https://cve.now/CVE-2024-10860.md): NextMove Lite – Thank You Page for WooCommerce \<= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission (CVSS 4.3, xlplugins NextMove Lite – Thank You Page for WooCommerce)
- [CVE-2025-22492](https://cve.now/CVE-2025-22492.md): Insecure storage of connection strings in FRS (CVSS 6.3, Eaton Foreseer Reporting Software)
- [CVE-2025-1413](https://cve.now/CVE-2025-1413.md): Dylib Hijacking in DaVinci Resolve (CVSS 8.4, Blackmagic Design DaVinci Resolve)
- [CVE-2025-22491](https://cve.now/CVE-2025-22491.md): Improper Input Validation in Foreseer Reporting Software (FRS) (CVSS 6.7, Eaton Foreseer Reporting Software)
- [CVE-2024-8420](https://cve.now/CVE-2024-8420.md): DHVC Form \<= 2.4.7 - Unauthenticated Privilege Escalation (CVSS 9.8, SiteSao DHVC Form)
- [CVE-2024-13851](https://cve.now/CVE-2024-13851.md): Modal Portfolio \<= 1.7.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, evigeo Modal Portfolio)
- [CVE-2024-9195](https://cve.now/CVE-2024-9195.md): WHMPress - WHMCS Client Area \<= 4.3-revision-3- Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, creativeon WHMCS Client Area for WordPress by WHMpress)
- [CVE-2025-1662](https://cve.now/CVE-2025-1662.md): URL Media Uploader \<= 1.0.0 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebinding (CVSS 6.4, apprhyme URL Media Uploader)
- [CVE-2025-1570](https://cve.now/CVE-2025-1570.md): Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings \<= 8.1 - Privilege Escalation and Account Takeover via Weak OTP (CVSS 8.1, wpwax Directorist: AI-Powered Business Directory, Listings…)
- [CVE-2024-13638](https://cve.now/CVE-2024-13638.md): Order Attachments for WooCommerce \<= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 5.9, sldesignpl Order Attachments for WooCommerce)
- [CVE-2024-13831](https://cve.now/CVE-2024-13831.md): Tabs for WooCommerce \<= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product\_has\_custom\_tabs (CVSS 7.2, wpbranch Tabs for WooCommerce)
- [CVE-2024-8425](https://cve.now/CVE-2024-8425.md): WooCommerce Ultimate Gift Card \<= 2.9.2 - Unauthenticated Arbitrary File Upload (CVSS 9.8, WP Swings WooCommerce Ultimate Gift Card)
- [CVE-2024-9193](https://cve.now/CVE-2024-9193.md): WHMpress \<= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update (CVSS 9.8, creativeon WHMpress - WHMCS WordPress Integration Plugin)
- [CVE-2024-9019](https://cve.now/CVE-2024-9019.md): SecuPress Free — WordPress Security \<= 2.2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via secupress\_check\_ban\_ips\_form Shortcode (CVSS 6.4, SecuPress with Simple SSL – Simple and Performant Security)
- [CVE-2024-13469](https://cve.now/CVE-2024-13469.md): Pricing Table by PickPlugins \<= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, PickPlugins Pricing Table)
- [CVE-2024-13716](https://cve.now/CVE-2024-13716.md): Forex Calculators \<= 1.3.7 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, tarborali Forex Calculators)
- [CVE-2024-13832](https://cve.now/CVE-2024-13832.md): Ultra Addons Lite for Elementor \<= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure (CVSS 4.3, ultrapressorg Ultra Addons Lite for Elementor)
- [CVE-2025-1560](https://cve.now/CVE-2025-1560.md): WOW Entrance Effects (WEE!) \<= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, darkosxrc WOW Entrance Effects)
- [CVE-2025-1572](https://cve.now/CVE-2025-1572.md): KiviCare – Clinic & Patient Management System (EHR) \<= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u\_id' Parameter (CVSS 6.5, iqonicdesign KiviCare – Clinic & Patient Management System)
- [CVE-2025-1571](https://cve.now/CVE-2025-1571.md): Exclusive Addons for Elementor \<= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison Widgets (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2025-1405](https://cve.now/CVE-2025-1405.md): Product Catalog Simple \<= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via show\_products Shortcode (CVSS 6.4, implecode Product Catalog Simple)
- [CVE-2025-0764](https://cve.now/CVE-2025-0764.md): wpForo Forum \<= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update (CVSS 6.5, tomdever wpForo Forum)
- [CVE-2025-1506](https://cve.now/CVE-2025-1506.md): Wp Social Login and Register Social Counter \<= 3.1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, roxnor Wp Social Login and Register Social Counter)
- [CVE-2024-12820](https://cve.now/CVE-2024-12820.md): MK Google Directions \<= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, manoj\_rana91986 MK Google Directions)
- [CVE-2025-1513](https://cve.now/CVE-2025-1513.md): Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons \<= 26.0.0.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, contest-gallery Contest Gallery – Upload & Vote Photos, Med…)
- [CVE-2025-1511](https://cve.now/CVE-2025-1511.md): User Registration & Membership – Custom Registration Form, Login Form, and User Profile \<= 4.0.4 - Reflected Cross-Site Scripting (CVSS 6.1, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2025-0801](https://cve.now/CVE-2025-0801.md): RateMyAgent Official \<= 1.4.0 - Cross-Site Request Forgery to API Key Update (CVSS 4.3, RateMyAgent Official)
- [CVE-2025-1505](https://cve.now/CVE-2025-1505.md): Advanced AJAX Product Filters \<= 1.6.8.1 - Reflected Cross-Site Scripting (CVSS 6.1, berocket Advanced AJAX Product Filters)
- [CVE-2025-1757](https://cve.now/CVE-2025-1757.md): WordPress Portfolio Builder – Portfolio Gallery \<= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, portfoliohub WordPress Portfolio Builder – Portfolio Gallery)
- [CVE-2024-13796](https://cve.now/CVE-2024-13796.md): Post Grid and Gutenberg Blocks – ComboBlocks \<= 2.3.6 - Unauthenticated User Information Exposure (CVSS 5.3, pickplugins Post Grid)
- [CVE-2025-1744](https://cve.now/CVE-2025-1744.md): Out-of-bounds Write in radare2 (CVSS 10.0, radareorg radare2)
- [CVE-2024-56340](https://cve.now/CVE-2024-56340.md): IBM Cognos Analytics path traversal (CVSS 6.5, IBM Cognos Analytics)
- [CVE-2025-0823](https://cve.now/CVE-2025-0823.md): IBM MQ path traversal (CVSS 6.5, IBM Cognos Analytics)
- [CVE-2025-23225](https://cve.now/CVE-2025-23225.md): IBM MQ denial of service (CVSS 6.5, IBM MQ)
- [CVE-2024-54173](https://cve.now/CVE-2024-54173.md): IBM MQ information disclosure (CVSS 4.7, IBM MQ)
- [CVE-2025-0975](https://cve.now/CVE-2025-0975.md): IBM MQ code execution (CVSS 8.8, IBM MQ)
- [CVE-2024-44754](https://cve.now/CVE-2024-44754.md): Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate attackers to inject mo (CVSS 6.8)
- [CVE-2025-25379](https://cve.now/CVE-2025-25379.md): Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the (CVSS 9.6)
- [CVE-2025-25428](https://cve.now/CVE-2025-25428.md): TRENDnet TEW-929DRU 1.0.0.10 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in a (CVSS 8.0)
- [CVE-2025-25429](https://cve.now/CVE-2025-25429.md): Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the r\_name variable inside the have\_same\_name fu (CVSS 4.8)
- [CVE-2025-25430](https://cve.now/CVE-2025-25430.md): Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the configname parameter on the /cbi\_addcert.htm (CVSS 4.8)
- [CVE-2025-25431](https://cve.now/CVE-2025-25431.md): Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the The ssid key of wifi\_data parameter on the / (CVSS 4.8)
- [CVE-2025-25461](https://cve.now/CVE-2025-25461.md): A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. (CVSS 5.4)
- [CVE-2025-25476](https://cve.now/CVE-2025-25476.md): A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Jav (CVSS 5.4)
- [CVE-2025-25478](https://cve.now/CVE-2025-25478.md): The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. (CVSS 6.5)
- [CVE-2025-25609](https://cve.now/CVE-2025-25609.md): TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. (CVSS 8.0)
- [CVE-2025-25610](https://cve.now/CVE-2025-25610.md): TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. (CVSS 8.0)
- [CVE-2025-25635](https://cve.now/CVE-2025-25635.md): TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. (CVSS 8.0)
- [CVE-2025-25723](https://cve.now/CVE-2025-25723.md): Buffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code. (CVSS 8.4)
- [CVE-2025-25916](https://cve.now/CVE-2025-25916.md): wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \\coreframe\\app\\member\\admin\\group.php. (CVSS 5.4)
- [CVE-2025-26047](https://cve.now/CVE-2025-26047.md): Loggrove v1.0 is vulnerable to SQL Injection in the read.py file. (CVSS 5.1)
- [CVE-2025-26263](https://cve.now/CVE-2025-26263.md): GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure d (CVSS 5.1)
- [CVE-2025-26326](https://cve.now/CVE-2025-26326.md): A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which a (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.