Skip to content
OpenAdvisories

Archive

13 February 2025

Vulnerabilities first published on this day (UTC), newest first.

← January 2025 2025 / February /13 March 2025 →
  1. 139
  2. 24
  3. 3187
  4. 4151
  5. 5119
  6. 699
  7. 7120
  8. 87
  9. 94
  10. 1081
  11. 11283
  12. 12265
  13. 13132
  14. 14134
  15. 1524
  16. 1640
  17. 1748
  18. 18162
  19. 19125
  20. 20120
  21. 2192
  22. 2234
  23. 2330
  24. 24119
  25. 25144
  26. 26795
  27. 27275
  28. 2887
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-25067

    mySCADA myPRO Manager OS Command Injection

    mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands.

    mySCADA myPRO Manager
  • Critical 10.0
    CVE-2025-24865 Public exploit

    mySCADA myPRO Manager Missing Authentication for Critical Function

    The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.

    mySCADA myPRO Manager
  • Critical 9.8
    CVE-2025-1283

    Dingtian DT-R0 Series Authentication Bypass Using an Alternate Path or Channel

    The Dingtian DT-R0 Series is vulnerable to an exploit that allows attackers to bypass login requirements by directly navigating to the main page.

    Dingtian DT-R002 DT-R016 DT-R008
  • Critical 9.1
    CVE-2025-1127

    Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server

    The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem.

    Lexmark CX, XC, CS, MS, MX, XM, et. al.
  • Critical 9.1
    CVE-2025-1270

    Insecure direct object reference (IDOR) vulnerability in H6Web

    Insecure direct object reference (IDOR) vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a POST request and modifying the “pkrelated” parameter in the “/h6web/ha_datos_hermano.php” endpoint to…

    Anapi Group H6Web
  • Critical 9.8
    CVE-2024-13182

    WP Directorybox Manager <= 2.5 - Authentication Bypass

    The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attack…

    Chimpstudio WP Directorybox Manager Web / CMS
  • Critical 9.8
    CVE-2024-10763 Scanner template

    Campress <= 1.35 - Unauthenticated Local File Inclusion

    The Campress theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.35 via the 'campress_woocommerce_get_ajax_products' function. This makes it possible for unauthenticated attackers to include and execute arbitrary …

    ApusTheme Campress Web / CMS
  • Critical 9.8
    CVE-2025-0896

    Orthanc Server Missing Authentication for Critical Function

    Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled. This could result in unauthorized access by an attacker.

    Orthanc Orthanc server orthanc orthanc Debian Ubuntu
  • Critical 9.6
    CVE-2024-7102

    Execution with Unnecessary Privileges in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another user under certain circumstances.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Critical 9.8
    CVE-2025-25286

    Crayfish allows Remote Code Execution via Homarus Authorization header

    Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The i…

    Islandora Crayfish islandora/crayfish Packagist
  • Critical 9.8
    CVE-2023-34399

    Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this tabl…

  • Critical 9.8
    CVE-2025-25388

    A SQL Injection vulnerability was found in /admin/edit-propertytype.php in PHPGurukul Land Record System v1.0, which al…

  • Critical 9.8
    CVE-2025-25389

    A SQL Injection vulnerability was found in /admin/forgot-password.php in Phpgurukul Land Record System v1.0, which allo…