Skip to content
OpenAdvisories

Archive

24 February 2025

Vulnerabilities first published on this day (UTC), newest first.

← January 2025 2025 / February /24 March 2025 →
  1. 139
  2. 24
  3. 3187
  4. 4151
  5. 5119
  6. 699
  7. 7120
  8. 87
  9. 94
  10. 1081
  11. 11283
  12. 12265
  13. 13132
  14. 14134
  15. 1524
  16. 1640
  17. 1748
  18. 18162
  19. 19125
  20. 20120
  21. 2192
  22. 2234
  23. 2330
  24. 24119
  25. 25144
  26. 26795
  27. 27275
  28. 2887
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-27140

    WeGIA vulnerable to OS Command Injection at endpoint 'importar_dump.php' parameter 'import' (RCE)

    WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the WeGIA application, `importar_dump.php` endpoint. This vulnerability could allow an attacker to execute arbitrary code r…

    LabRedesCefetRJ WeGIA
  • Critical 9.4
    CVE-2025-27133

    WeGIA has SQL Injection endpoint at 'dao/pet/adicionar_tipo_exame.php' parameter 'tipo_exame'

    WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3.2.15 at the `adicionar_tipo_exame.php` endpoint. This vulnerability allows an authorized attacker to execute arbitrary…

    LabRedesCefetRJ WeGIA
  • Critical 9.9
    CVE-2025-20051

    Arbitrary file read via block duplication in Mattermost Boards

    Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted …

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Critical 9.6
    CVE-2025-24490

    SQL Injection in Mattermost Boards via board category ID reordering

    Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering s…

    Mattermost Mattermost
  • Critical 9.9
    CVE-2025-25279 Public exploit EPSS 24%

    Arbitrary file read in Mattermost Boards via import & export board archive

    Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a speciall…

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Critical 9.8
    CVE-2024-53544

    NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerabilit…

  • Critical 9.8
    CVE-2024-54820 Public exploit

    XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login…

  • Critical 9.8
    CVE-2024-56525

    In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Jour…

  • Critical 9.8
    CVE-2024-56897

    Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API…

  • Critical 10.0
    CVE-2025-27364 EPSS 26%

    In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the d…

    MITRE Caldera
  • Critical 9.8
    CVE-2025-25513

    Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.

  • Critical 9.8
    CVE-2025-22974

    SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTr…

  • Critical 9.1
    CVE-2025-26201

    Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attack…