Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2025

189 records · 15 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2024-13097
    21Monitor

    WP Finance <= 1.3.6 - Reflected XSS

    MediumCVSS 5.4Proof of conceptEPSS 0%

    mch0lic · wp financeFeb 1, 2025

  • CVE-2024-13098
    21Monitor

    WP Email Newsletter <= 1.1 - Reflected XSS

    MediumCVSS 5.4Proof of conceptEPSS 0%

    megamindstechnologies · wordpress email newsletterFeb 1, 2025

  • CVE-2024-13099
    21Monitor

    Widget4call <= 1.0.7 - Reflected XSS

    MediumCVSS 5.4Proof of conceptEPSS 0%

    apidaze · widget4callFeb 1, 2025

  • CVE-2025-25062
    18Monitor

    An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.

    MediumCVSS 4.4Proof of conceptEPSS 1%

    backdropcms · backdrop cmsFeb 3, 2025

  • CVE-2025-25066
    33Monitor

    nDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in lib/ndpi_cache.c.

    HighCVSS 8.4No exploitEPSS 0%

    ntop · ndpiFeb 3, 2025

  • CVE-2024-57522
    25Monitor

    SourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in Users.php.

    MediumCVSS 6.4Proof of conceptEPSS 1%

    oretnom23 · packers and movers management systemFeb 3, 2025

  • CVE-2024-36437
    26Monitor

    The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (wi

    MediumCVSS 6.5Proof of conceptEPSS 0%

    Feb 3, 2025

  • CVE-2024-53942
    24Monitor

    An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices.

    MediumCVSS 4.8No exploitEPSS 15%

    Feb 3, 2025

  • CVE-2024-57175
    21Monitor

    A Stored Cross-Site Scripting (XSS) vulnerability was identified in the PHPGURUKUL Online Birth Certificate System v1.0 via the profile name

    MediumCVSS 5.4Proof of conceptEPSS 0%

    phpgurukul · online birth certificate systemFeb 3, 2025

  • CVE-2024-57004
    36Monitor

    Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email

    MediumCVSS 6.1No exploitEPSS 39%

    roundcube · webmailFeb 3, 2025

  • CVE-2024-57968
    75This week

    Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible

    HighCVSS 8.8KEVWeaponizedEPSS 32%

    advantive · veracoreFeb 3, 2025

  • CVE-2025-25064
    46Plan

    SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 d

    HighCVSS 8.8Proof of conceptEPSS 36%

    synacor · zimbra collaboration suiteFeb 3, 2025

  • CVE-2025-25181
    77This week

    A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL

    HighCVSS 7.5KEVWeaponizedEPSS 55%

    advantive · veracoreFeb 3, 2025

  • CVE-2023-52163
    94Now

    Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection.

    HighCVSS 8.8KEVWeaponizedEPSS 96%

    digiever · ds-2105 pro firmwareFeb 3, 2025

  • CVE-2024-56898
    36Monitor

    Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less.

    HighCVSS 8.8Proof of conceptEPSS 2%

    Feb 3, 2025

  • CVE-2024-56901
    36Monitor

    A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers t

    HighCVSS 8.8Proof of conceptEPSS 1%

    Feb 3, 2025

  • CVE-2024-56902
    37Monitor

    Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account in

    HighCVSS 7.5Proof of conceptEPSS 23%

    Feb 3, 2025

  • CVE-2024-13114
    24Monitor

    WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    phptechie · wp projects portfolio with client testimonialsFeb 4, 2025

  • CVE-2024-13325
    24Monitor

    Glossy <= 2.3.5 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    croberts · glossyFeb 4, 2025

  • CVE-2024-13326
    24Monitor

    iBuildApp <= 0.2.0 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    ibuildapp · ibuildappFeb 4, 2025

  • CVE-2024-13327
    24Monitor

    Musicbox <= 2.0.3 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    webdesignby · musicboxFeb 4, 2025

  • CVE-2024-13328
    24Monitor

    Giga Messenger Bots <= 2.3.1 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    tanng · giga messengerFeb 4, 2025

  • CVE-2024-13330
    28Monitor

    Justrows Free <= 0.2 - Reflected XSS

    HighCVSS 7.1Proof of conceptEPSS 0%

    canaveralstudio · justrows freeFeb 4, 2025

  • CVE-2024-13331
    24Monitor

    WP Dream Carousel <= 1.0.1b - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    neoloki · wp dream carouselFeb 4, 2025

  • CVE-2024-40890
    71This week

    **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B

    HighCVSS 8.8KEVWeaponizedEPSS 20%

    zyxel · vmg1312-b10a firmwareFeb 4, 2025

  • CVE-2024-40891
    72This week

    **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel V

    HighCVSS 8.8KEVWeaponizedEPSS 21%

    zyxel · vmg1312-b10a firmwareFeb 4, 2025

  • CVE-2025-0890
    43Plan

    **UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    zyxel · vmg4325-b10a firmwareFeb 4, 2025

  • CVE-2025-1015
    21Monitor

    Unsanitized address book fields

    MediumCVSS 5.4Proof of conceptEPSS 1%

    mozilla · thunderbirdFeb 4, 2025

  • CVE-2024-9643
    40Plan

    Four-Faith F3x36 Hidden Debug Credentials

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    four-faith · f3x36 firmwareFeb 4, 2025

  • CVE-2025-0364
    40Plan

    BigAntSoft BigAnt Server Account Registration Bypass to File Upload RCE

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    bigantsoft · bigant serverFeb 4, 2025

  • CVE-2025-24971
    39Monitor

    OS Command Injection endpoint '/upload/init' parameter 'filename' (RCE) in DumpDrop

    CriticalCVSS 9.5Proof of conceptEPSS 3%

    dumbwareio · dumbdropFeb 4, 2025

  • CVE-2025-24963
    31Monitor

    Browser mode serves arbitrary files in vitest

    HighCVSS 7.5Proof of conceptEPSS 2%

    vitest.dev · vitestFeb 4, 2025

  • CVE-2024-11467
    31Monitor

    Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw.

    HighCVSS 7.8Proof of conceptEPSS 0%

    omnissa · omnissa horizon client for macosFeb 4, 2025

  • CVE-2024-48445
    40Plan

    An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    Feb 4, 2025

  • CVE-2025-1025
    36Monitor

    Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extensio

    HighCVSS 7.7Proof of conceptEPSS 18%

    Feb 5, 2025

  • CVE-2024-2878
    36Monitor

    Allocation of Resources Without Limits or Throttling in GitLab

    HighCVSS 7.5No exploitEPSS 19%

    gitlab · gitlabFeb 5, 2025

  • CVE-2025-0725
    30Monitor

    gzip integer overflow

    HighCVSS 7.3No exploitEPSS 1%

    netapp · hci baseboard management controllerFeb 5, 2025

  • CVE-2025-20124
    34Monitor

    Cisco Identity Services Engine Java Deserialization Vulnerability

    HighCVSS 7.2Proof of conceptEPSS 18%

    cisco · identity services engineFeb 5, 2025

  • CVE-2025-20125
    33Monitor

    Cisco Identity Services Engine Insufficient Authorization Bypass Vulnerability

    HighCVSS 7.2Proof of conceptEPSS 16%

    cisco · identity services engineFeb 5, 2025

  • CVE-2024-7595
    26Monitor

    GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet

    MediumCVSS 6.5Proof of conceptEPSS 1%

    ietf · generic routing encapsulationFeb 5, 2025

  • CVE-2025-20029
    36Monitor

    BIG-IP iControl REST and tmsh vulnerability

    HighCVSS 8.7Proof of conceptEPSS 7%

    f5 · big-ip access policy managerFeb 5, 2025

  • CVE-2025-23419
    22Monitor

    TLS Session Resumption Vulnerability

    MediumCVSS 5.3Proof of conceptEPSS 2%

    f5 · nginxFeb 5, 2025

  • CVE-2025-0994
    73This week

    Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization v

    HighCVSS 8.6KEVWeaponizedEPSS 31%

    trimble · cityworksFeb 6, 2025

  • CVE-2022-40490
    19Monitor

    Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability.

    MediumCVSS 4.8Proof of conceptEPSS 0%

    prasathmani · tiny file managerFeb 6, 2025

  • CVE-2022-40916
    39Monitor

    Tiny File Manager v2.4.7 and below is vulnerable to session fixation.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    prasathmani · tiny file managerFeb 6, 2025

  • CVE-2024-57427
    24Monitor

    PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS).

    MediumCVSS 6.1Proof of conceptEPSS 0%

    phpjabbers · cinema booking systemFeb 6, 2025

  • CVE-2024-57428
    37Monitor

    A stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fi

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    phpjabbers · cinema booking systemFeb 6, 2025

  • CVE-2024-57429
    21Monitor

    A cross-site request forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote atta

    MediumCVSS 5.4Proof of conceptEPSS 0%

    phpjabbers · cinema booking systemFeb 6, 2025

  • CVE-2024-57430
    39Monitor

    An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate datab

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    phpjabbers · cinema booking systemFeb 6, 2025

  • CVE-2024-57610
    30Monitor

    A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly

    HighCVSS 7.5Proof of conceptEPSS 1%

    sylius · syliusFeb 6, 2025

  • CVE-2024-57523
    18Monitor

    Cross Site Request Forgery (CSRF) in Users.php in SourceCodester Packers and Movers Management System 1.0 allows attackers to create unautho

    MediumCVSS 4.5Proof of conceptEPSS 0%

    oretnom23 · packers and movers management systemFeb 6, 2025

  • CVE-2025-24786
    37Monitor

    Path traversal opening Sqlite3 database in WhoDB

    CriticalCVSS 9.1Proof of conceptEPSS 2%

    clidey · whodbFeb 6, 2025

  • CVE-2024-48589
    25Monitor

    Cross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code via the rol parameter

    MediumCVSS 6.3Proof of conceptEPSS 0%

    Feb 6, 2025

  • CVE-2024-53586
    22Monitor

    An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a crafted HTTP request.

    MediumCVSS 5.3Proof of conceptEPSS 1%

    Feb 6, 2025

  • CVE-2024-56889
    30Monitor

    Incorrect access control in the endpoint /admin/m_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to

    HighCVSS 7.5Proof of conceptEPSS 0%

    codeastro · complaint management systemFeb 6, 2025

  • CVE-2025-0674
    38Monitor

    Elber Communications Equipment Authentication Bypass Using an Alternate Path or Channel

    CriticalCVSS 9.3Proof of conceptEPSS 3%

    elber · signum dvb-s/s2 irdFeb 6, 2025

  • CVE-2024-13352
    28Monitor

    Legull <= 1.2.2 - Reflected XSS

    HighCVSS 7.1Proof of conceptEPSS 0%

    alwayscurious · legullFeb 7, 2025

  • CVE-2024-13492
    24Monitor

    Guten Free Options <= 0.9.5 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    wordquest · guten free optionsFeb 7, 2025

  • CVE-2025-25101
    38Monitor

    WordPress Munk Sites plugin <= 1.0.7 - CSRF to Arbitrary Plugin Installation vulnerability

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    metricthemes · munk sitesFeb 7, 2025

  • CVE-2025-25163
    40Plan

    WordPress Plugin A/B Image Optimizer Plugin <= 3.3 - Arbitrary File Download vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    pluginab · plugin a\/b image optimizerFeb 7, 2025

  • CVE-2024-35106
    18Monitor

    NEXTU FLETA AX1500 WIFI6 v1.0.3 was discovered to contain a buffer overflow at /boafrm/formIpQoS.

    MediumCVSS 4.6Proof of conceptEPSS 0%

    Feb 7, 2025

  • CVE-2025-1103
    32Monitor

    D-Link DIR-823X HTTP POST Request set_wifi_blacklists null pointer dereference

    HighCVSS 7.1No exploitEPSS 14%

    dlink · dir-823x firmwareFeb 7, 2025

  • CVE-2024-55215
    39Monitor

    An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    jrohy · trojanFeb 7, 2025

  • CVE-2025-0316
    39Monitor

    WP Directorybox Manager <= 2.5 - Authentication Bypass

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    chimpstudio · wp directorybox managerFeb 8, 2025

  • CVE-2024-13059
    34Monitor

    Path Traversal in mintplex-labs/anything-llm

    HighCVSS 7.2No exploitEPSS 21%

    mintplexlabs · anythingllmFeb 10, 2025

  • CVE-2025-24200
    55Plan

    An authorization issue was addressed with improved state management.

    MediumCVSS 6.1KEVWeaponizedEPSS 4%

    apple · ipadosFeb 10, 2025

  • CVE-2025-21692
    31Monitor

    net: sched: fix ets qdisc OOB Indexing

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelFeb 10, 2025

  • CVE-2025-24016
    97Now

    Remote code execution in Wazuh server

    CriticalCVSS 9.9KEVWeaponizedEPSS 93%

    wazuh · wazuhFeb 10, 2025

  • CVE-2025-0054
    21Monitor

    Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java

    MediumCVSS 5.4Proof of conceptEPSS 0%

    sap_se · sap netweaver application server javaFeb 10, 2025

  • CVE-2024-13543
    24Monitor

    Zarinpal Paid Downloads <= 2.3 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    amini7 · zarinpal paid downloadFeb 11, 2025

  • CVE-2024-13570
    24Monitor

    Stray Random Quotes <= 1.9.9 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    unalignedcode · stray random quotesFeb 11, 2025

  • CVE-2024-47908
    35Monitor

    OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privilege

    HighCVSS 7.2No exploitEPSS 22%

    ivanti · cloud services applianceFeb 11, 2025

  • CVE-2024-27781
    44Plan

    An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through

    CriticalCVSS 9.0No exploitEPSS 28%

    fortinet · fortisandboxFeb 11, 2025

  • CVE-2024-40586
    26Monitor

    An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, version 7.0.13 and below m

    MediumCVSS 6.7Proof of conceptEPSS 0%

    fortinet · forticlientFeb 11, 2025

  • CVE-2025-24472
    64This week

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.

    HighCVSS 8.1KEVWeaponizedEPSS 7%

    fortinet · fortiproxyFeb 11, 2025

  • CVE-2025-21377
    38Monitor

    NTLM Hash Disclosure Spoofing Vulnerability

    MediumCVSS 6.5No exploitEPSS 39%

    microsoft · windows 10 1507Feb 11, 2025

  • CVE-2025-21391
    59Plan

    Windows Storage Elevation of Privilege Vulnerability

    HighCVSS 7.1KEVWeaponizedEPSS 2%

    microsoft · windows 10 1507Feb 11, 2025

  • CVE-2025-21400
    42Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.0No exploitEPSS 34%

    microsoft · sharepoint serverFeb 11, 2025

  • CVE-2025-21418
    61This week

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    microsoft · windows 10 1607Feb 11, 2025

  • CVE-2025-21420
    32Monitor

    Windows Disk Cleanup Tool Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 3%

    microsoft · windows 10 1507Feb 11, 2025

  • CVE-2025-24434
    41Plan

    Adobe Commerce | Incorrect Authorization (CWE-863)

    CriticalCVSS 9.1No exploitEPSS 17%

    adobe · commerceFeb 11, 2025

  • CVE-2025-1044
    62This week

    Logsign Unified SecOps Platform Authentication Bypass Vulnerability

    CriticalCVSS 9.8No exploitEPSS 75%

    logsign · unified secops platformFeb 11, 2025

  • CVE-2024-51324
    15Monitor

    An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via executing a BYOVD (Bri

    LowCVSS 3.8Proof of conceptEPSS 0%

    Feb 11, 2025

  • CVE-2024-57241
    26Monitor

    Dedecms 5.71sp1 and earlier is vulnerable to URL redirect.

    MediumCVSS 6.5Proof of conceptEPSS 1%

    dedecms · dedecmsFeb 11, 2025

  • CVE-2025-1240
    38Monitor

    WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 10%

    winzip · winzipFeb 11, 2025

  • CVE-2024-54772
    21Monitor

    An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.1

    MediumCVSS 5.4Proof of conceptEPSS 1%

    mikrotik · routerosFeb 11, 2025

  • CVE-2024-54916
    27Monitor

    An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass authentication and esca

    MediumCVSS 6.8Proof of conceptEPSS 0%

    Feb 11, 2025

  • CVE-2024-13800
    32Monitor

    Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

    HighCVSS 8.1Proof of conceptEPSS 0%

    convertplug · convertplusFeb 12, 2025

  • CVE-2024-54160
    25Monitor

    dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because Markdown is not sani

    MediumCVSS 6.4Proof of conceptEPSS 0%

    lf projects · opensearchFeb 12, 2025

  • CVE-2025-25198
    35Monitor

    mailcow: dockerized vulnerable to password reset poisoning

    HighCVSS 8.8Proof of conceptEPSS 1%

    mailcow · mailcow\Feb 12, 2025

  • CVE-2025-25200
    36Monitor

    Koa has Inefficient Regular Expression Complexity

    CriticalCVSS 9.2Proof of conceptEPSS 0%

    koajs · koaFeb 12, 2025

  • CVE-2025-1146
    32Monitor

    CrowdStrike Falcon Sensor for Linux TLS Issue

    HighCVSS 8.1No exploitEPSS 0%

    crowdstrike · falcon sensor for linuxFeb 12, 2025

  • CVE-2025-1215
    9Monitor

    vim main.c memory corruption

    LowCVSS 2.4No exploitEPSS 0%

    vim · vimFeb 12, 2025

  • CVE-2025-25205
    60This week

    Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching

    HighCVSS 8.2WeaponizedEPSS 4%

    audiobookshelf · audiobookshelfFeb 12, 2025

  • CVE-2025-0108
    95Now

    PAN-OS: Authentication Bypass in the Management Web Interface

    HighCVSS 8.8KEVWeaponizedEPSS 98%

    paloaltonetworks · pan-osFeb 12, 2025

  • CVE-2025-0111
    59Plan

    PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface

    HighCVSS 7.1KEVWeaponizedEPSS 1%

    paloaltonetworks · pan-osFeb 12, 2025

  • CVE-2024-10763
    40Plan

    Campress <= 1.35 - Unauthenticated Local File Inclusion

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    apuswp · campressFeb 13, 2025

  • CVE-2024-13346
    40Plan

    Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    theme-fusion · avadaFeb 13, 2025

  • CVE-2025-1094
    60This week

    PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

    HighCVSS 8.1WeaponizedEPSS 90%

    Feb 13, 2025

  • CVE-2025-26543
    28Monitor

    WordPress Simple Responsive Menu plugin <= 2.1 - CSRF to Stored XSS vulnerability

    HighCVSS 7.1Proof of conceptEPSS 0%

    pukhraj suthar · simple responsive menuFeb 13, 2025