# CVEs published 2026-02-01

34 CVEs were published on February 1, 2026: 0 critical, 15 high. Days are UTC.

- [CVE-2026-1734](https://cve.now/CVE-2026-1734.md): Zhong Bang CRMEB crontab Endpoint CrontabController.php authorization (CVSS 6.9, Zhong Bang CRMEB)
- [CVE-2026-1733](https://cve.now/CVE-2026-1733.md): Zhong Bang CRMEB :uni tidyOrder improper authorization (CVSS 5.3, Zhong Bang CRMEB)
- [CVE-2026-25253](https://cve.now/CVE-2026-25253.md): OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket conne (CVSS 8.8, OpenClaw · clawdbot)
- [CVE-2020-37064](https://cve.now/CVE-2020-37064.md): EPSON EasyMP Network Projection 2.81 - 'EMP\_NSWLSV' Unquoted Service Path (CVSS 8.5, EPSON EasyMP Network Projection)
- [CVE-2020-37063](https://cve.now/CVE-2020-37063.md): TFTP Turbo 4.6.1273 - 'TFTP Turbo 4' Unquoted Service Path (CVSS 8.5, Weird-Solutions TFTP Turbo)
- [CVE-2020-37062](https://cve.now/CVE-2020-37062.md): DHCP Turbo 4.6.1298- 'DHCP Turbo 4' Unquoted Service Path (CVSS 8.5, Weird Solutions DHCP Turbo)
- [CVE-2020-37061](https://cve.now/CVE-2020-37061.md): BOOTP Turbo 2.0.1214 - 'BOOTP Turbo' Unquoted Service Path (CVSS 8.5, Weird-Solutions BOOTP Turbo)
- [CVE-2020-37055](https://cve.now/CVE-2020-37055.md): SpyHunter 4 - 'SpyHunter 4 Service' Unquoted Service Path (CVSS 8.5, Enigmasoftware SpyHunter)
- [CVE-2020-37048](https://cve.now/CVE-2020-37048.md): Iskysoft Application Framework Service 2.4.3.241 - 'IsAppService' Unquoted Service Path (CVSS 8.5, Iskysoft Application Framework Service)
- [CVE-2020-37047](https://cve.now/CVE-2020-37047.md): Deep Instinct Windows Agent 1.2.29.0 - 'DeepMgmtService' Unquoted Service Path (CVSS 8.5, Deepinstinct Deep Instinct Windows Agent)
- [CVE-2020-37045](https://cve.now/CVE-2020-37045.md): NetBackup 7.0 - 'NetBackup INET Daemon' Unquoted Service Path (CVSS 8.5, Veritas NetBackup)
- [CVE-2020-37037](https://cve.now/CVE-2020-37037.md): AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path (CVSS 8.5, AVAST SecureLine)
- [CVE-2023-54343](https://cve.now/CVE-2023-54343.md): QWE DL 2.0.1 Persistent XSS Vulnerability via Path Parameter (CVSS 5.1, QWE Labs QWE DL)
- [CVE-2022-50952](https://cve.now/CVE-2022-50952.md): Banco Guayaquil 8.0.0 Mobile iOS Cross-Site Scripting via Profile Name Input (CVSS 5.1, Banco de Guayaquil Banco Guayaquil)
- [CVE-2022-50951](https://cve.now/CVE-2022-50951.md): WiFi File Transfer 1.0.8 Persistent XSS via Web Server Input Validation (CVSS 5.1, smarterDroid WiFi File Transfer)
- [CVE-2022-50950](https://cve.now/CVE-2022-50950.md): Webile 1.0.1 Directory Traversal Vulnerability via Web Application (CVSS 7.1, Product Owner: Webile Webile)
- [CVE-2021-47921](https://cve.now/CVE-2021-47921.md): Free Photo & Video Vault 0.0.2 Directory Traversal Vulnerability via Web Request (CVSS 7.1, Author: Scott Ferreira Free Photo & Video Vault - WiFi Tran…)
- [CVE-2022-50942](https://cve.now/CVE-2022-50942.md): Incinga Web 2.8.2 Client-Side Cross-Site Scripting via EventListener (CVSS 4.8, Incinga Web)
- [CVE-2022-50941](https://cve.now/CVE-2022-50941.md): BootCommerce 3.2.1 Persistent Cross-Site Scripting via Order Checkout (CVSS 5.1, MrPlugins BootCommerce)
- [CVE-2022-50940](https://cve.now/CVE-2022-50940.md): Knap Advanced PHP Login 3.1.3 Persistent Cross-Site Scripting via Name Parameter (CVSS 5.1, ajay138 Knap Advanced PHP Login)
- [CVE-2022-50797](https://cve.now/CVE-2022-50797.md): Stripe Green Downloads Wordpress Plugin 2.03 Persistent XSS via Settings (CVSS 5.1, halfdata Stripe Green Downloads)
- [CVE-2021-47920](https://cve.now/CVE-2021-47920.md): WebMO Job Manager 20.0 Cross-Site Scripting via Search Parameters (CVSS 4.8, WebMO Job Manager)
- [CVE-2021-47919](https://cve.now/CVE-2021-47919.md): Simple CMS 2.1 Non-Persistent Cross-Site Scripting via Preview Parameter (CVSS 5.1, Simplephpscripts Simple CMS)
- [CVE-2021-47918](https://cve.now/CVE-2021-47918.md): Simple CMS 2.1 SQL Injection Vulnerability via Users Module (CVSS 8.6, Simplephpscripts Simple CMS)
- [CVE-2021-47917](https://cve.now/CVE-2021-47917.md): Simple CMS 2.1 Persistent Cross-Site Scripting via User Input Parameters (CVSS 5.1, Simplephpscripts Simple CMS)
- [CVE-2021-47915](https://cve.now/CVE-2021-47915.md): PHP Melody 3.0 SQL Injection Vulnerability via Edit Video Parameter (CVSS 8.6, PHPSUGAR PHP Melody)
- [CVE-2021-47914](https://cve.now/CVE-2021-47914.md): PHP Melody 3.0 Persistent XSS Vulnerability via Edit Video Parameter (CVSS 5.1, PHPSUGAR PHP Melody)
- [CVE-2021-47913](https://cve.now/CVE-2021-47913.md): PHP Melody 3.0 Persistent Cross-Site Scripting via Video Editor (CVSS 5.1, PHPSUGAR PHP Melody)
- [CVE-2021-47912](https://cve.now/CVE-2021-47912.md): PHP Melody 3.0 Non-Persistent Cross-Site Scripting via Multiple Parameters (CVSS 5.1, PHPSUGAR PHP Melody)
- [CVE-2021-47911](https://cve.now/CVE-2021-47911.md): Affiliate Pro 1.7 Reflected Cross-Site Scripting via Index Module (CVSS 4.8, jdwebdesigner Affiliate Pro)
- [CVE-2021-47909](https://cve.now/CVE-2021-47909.md): Mult-E-Cart Ultimate 2.4 SQL Injection via Vulnerable ID Parameters (CVSS 8.6, Techraft Digital Multivendor Marketplace Online Store)
- [CVE-2021-47908](https://cve.now/CVE-2021-47908.md): Ultimate POS 4.4 Persistent Cross-Site Scripting via Product Name (CVSS 5.1)
- [CVE-2021-47885](https://cve.now/CVE-2021-47885.md): Payment Terminal Multiple Versions Non-Persistent Cross-Site Scripting (CVSS 5.1, CriticalGears PayPal PRO Payment Terminal · CriticalGear… +1)
- [CVE-2021-47856](https://cve.now/CVE-2021-47856.md): Easy Cart Shopping Cart 2021 Cross-Site Scripting via Search Parameter (CVSS 5.1, NetArt Media Easy Cart Shopping Cart)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.