Archive
February 2025
Vulnerabilities first published in this month (UTC), newest first.
40 results · Clear filters · Feed
-
Medium 5.9
Openssh: denial-of-service in openssh
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may k…
-
Medium 6.5CVE-2025-27410 Public exploit
PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin
PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting a…
-
Medium 5.4CVE-2025-25461 Public exploit
A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Categor…
-
Medium 5.1CVE-2025-26263 Public exploit
GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to cre…
-
Medium 6.2CVE-2025-1738 Public exploit
Multiple vulnerabilities in Trivision Camera NC227WF
A Password Transmitted over Query String vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity, exposing this sensitive information to a third party.
-
Medium 5.3CVE-2025-1716 Public exploit
picklescan - Security scanning bypass via 'pip main'
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted gl…
-
Medium 6.1CVE-2025-0690 Public exploit
Grub2: read: integer overflow may lead to out-of-bounds write
The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to reallocate the line buffer to accept the next character. During this process, with a line big enough it…
-
Medium 4.8CVE-2025-25460 Public exploit
A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. Thi…
-
Medium 6.8
A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute…
-
Medium 6.4CVE-2025-1489 Public exploit
WP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode
The WP-Appbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's appbox shortcode in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…
-
Medium 6.5
MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit t…
-
Medium 5.3
Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through…
-
Medium 6.0CVE-2025-25968 Public exploit
DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged u…
-
Medium 6.8CVE-2025-26465 Public exploit
Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific cond…
-
Medium 5.4CVE-2024-56882 Public exploit
Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role p…
-
Medium 6.1
Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint
Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query parameter. By crafting…
-
Medium 6.5CVE-2024-57725 Public exploit
An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value wi…
-
Medium 5.4CVE-2024-54951 Public exploit
Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS). A malicious user can create a malformed contact and use that …
-
Medium 5.9
PAN-OS: Authentication Bypass in the Management Web Interface
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certai…
KEV Feb 18, 2025 -
Medium 6.4CVE-2024-54160 Public exploit
dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because…
-
Medium 6.3CVE-2024-40586 Public exploit
An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, versi…
-
Medium 5.4CVE-2025-0054 Public exploit
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java
SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be la…
-
Medium 6.5
Dedecms 5.71sp1 and earlier is vulnerable to URL redirect. In the web application, a logic error does not judge the inp…
-
Medium 6.8CVE-2024-54916 Public exploit
An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass au…
-
Medium 5.4
An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stab…
-
Medium 4.6CVE-2024-35106 Public exploit
NEXTU FLETA AX1500 WIFI6 v1.0.3 was discovered to contain a buffer overflow at /boafrm/formIpQoS. This vulnerability al…
-
Medium 4.8CVE-2022-40490 Public exploit
Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability. This vulnerabi…
-
Medium 5.3CVE-2024-53586 Public exploit
An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a cr…
-
Medium 6.3CVE-2024-48589 Public exploit
Cross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code v…
-
Medium 4.5CVE-2024-57523 Public exploit
Cross Site Request Forgery (CSRF) in Users.php in SourceCodester Packers and Movers Management System 1.0 allows attack…
-
Medium 6.1CVE-2024-57427 Public exploit
PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS). Multiple endpoints imprope…
-
Medium 5.4CVE-2024-57429 Public exploit
A cross-site request forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2…
-
Medium 5.3CVE-2024-7595 Public exploit
GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet
GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network…
-
Medium 4.3CVE-2025-23419 Public exploit
TLS Session Resumption Vulnerability
When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://ngin…
-
Medium 5.9
Browser mode serves arbitrary files in vitest
Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a r…
-
Medium 5.4CVE-2025-1015 Public exploit
Unsanitized address book fields
The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If anoth…
-
Medium 6.5CVE-2024-36437 Public exploit
The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any inst…
-
Medium 5.4CVE-2024-57175 Public exploit
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the PHPGURUKUL Online Birth Certificate System v1.0…
-
Medium 6.4CVE-2024-57522 Public exploit
SourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in Users.php. An a…
-
Medium 4.4CVE-2025-25062 Public exploit
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isol…