По дате публикации
Эксплуатируемые и новые серьёзные CVE: февраль 2025 г.
190 записей · 15 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 2 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
30Наблюдать | CVE-2024-12013Эксплойта нет | A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h.zettler · 130.8005 · CWE-1392 | Высокая7,6 | — | 0,3 % | 13 февр. 2025 г. |
29Наблюдать | CVE-2024-57378Proof of concept | Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability.CWE-284 | Высокая7,3 | — | 0,2 % | 13 февр. 2025 г. |
60На этой неделе | CVE-2025-22896Готовый эксплойт | mySCADA myPRO Manager Cleartext Storage of Sensitive Informationmyscada · mypro · CWE-312 | Критическая9,2 | — | 3,5 % | 13 февр. 2025 г. |
60На этой неделе | CVE-2025-24865Готовый эксплойт | mySCADA myPRO Manager Missing Authentication for Critical Functionmyscada · mypro · CWE-306 | Критическая10,0 | — | 7,2 % | 13 февр. 2025 г. |
21Наблюдать | CVE-2024-54951Proof of concept | Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS).monicahq · monica · CWE-79 | Средняя5,4 | — | 0,5 % | 13 февр. 2025 г. |
33Наблюдать | CVE-2025-26788Proof of concept | StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.strongkey · fido server · CWE-639 | Высокая8,4 | — | 0,4 % | 14 февр. 2025 г. |
28Наблюдать | CVE-2024-57725Proof of concept | An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value without authentication,CWE-306 | Средняя6,5 | — | 6,2 % | 14 февр. 2025 г. |
35Наблюдать | CVE-2024-57778Proof of concept | An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from stCWE-269 | Высокая8,8 | — | 0,5 % | 14 февр. 2025 г. |
25Наблюдать | CVE-2025-25296Proof of concept | Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpointhumansignal · label studio · CWE-79 | Средняя6,1 | — | 1,8 % | 14 февр. 2025 г. |
38Наблюдать | CVE-2025-1302Proof of concept | Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.CWE-94 | Высокая8,9 | — | 10,3 % | 15 февр. 2025 г. |
39Наблюдать | CVE-2024-13513Proof of concept | Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalationoliverpos · oliver pos · CWE-862 | Критическая9,8 | — | 0,7 % | 15 февр. 2025 г. |
30Наблюдать | CVE-2024-13488Proof of concept | LTL Freight Quotes – Estes Edition <= 3.3.7 - Unauthenticated SQL Injectionenituretechnology · ltl freight quotes · CWE-89 | Высокая7,5 | — | 1,1 % | 15 февр. 2025 г. |
38Наблюдать | CVE-2025-26793Proof of concept | The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (usernhirsch · enterphone mesh · CWE-1393 | Критическая9,3 | — | 2,3 % | 15 февр. 2025 г. |
20Наблюдать | CVE-2025-1337Proof of concept | Eastnets PaymentSafe BIC Search cross site scriptingeastnets · paymentsafe · CWE-79 | Средняя5,1 | — | 0,5 % | 16 февр. 2025 г. |
42В плане | CVE-2025-1338Proof of concept | NUUO Camera handle_config.php print_file command injectionnuuo · camera · CWE-74 | Средняя6,9 | — | 51,1 % | 16 февр. 2025 г. |
39Наблюдать | CVE-2025-1340Эксплойта нет | TOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflowtotolink · x18 firmware · CWE-119 | Высокая8,7 | — | 16,6 % | 16 февр. 2025 г. |
24Наблюдать | CVE-2025-0924Proof of concept | WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scriptingmelapress · wp activity log · CWE-79 | Средняя6,1 | — | 1,3 % | 17 февр. 2025 г. |
28Наблюдать | CVE-2024-13625Proof of concept | Tube Video Ads Lite <= 1.5.7 - Reflected XSSgualdoni · tube video ads lite · CWE-79 | Высокая7,1 | — | 0,5 % | 17 февр. 2025 г. |
18Наблюдать | CVE-2024-13627Proof of concept | WP Touch Slider <= 2.2 - Reflected XSSwp-buy · owl carousel slider · CWE-79 | Средняя4,7 | — | 0,8 % | 17 февр. 2025 г. |
35Наблюдать | CVE-2024-13726Proof of concept | Themes Coder <= 1.3.4 - Unauthenticated SQLithemescoder · themes coder · CWE-89 | Высокая8,6 | — | 1,9 % | 17 февр. 2025 г. |
23Наблюдать | CVE-2024-13609Proof of concept | 1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backu1clickmigration · 1 click migration · CWE-200 | Средняя5,9 | — | 1,6 % | 18 февр. 2025 г. |
38Наблюдать | CVE-2025-1023Proof of concept | SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.phpchurchcrm · churchcrm · CWE-89 | Критическая9,3 | — | 2,4 % | 18 февр. 2025 г. |
25Наблюдать | CVE-2025-1035Proof of concept | Path Traversal in Komtera Technolgies' KLog Serverkomtera technolgies · klog server · CWE-22 | Средняя5,7 | — | 9,8 % | 18 февр. 2025 г. |
49В плане | CVE-2024-57045Proof of concept | A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authendlink · dir-859 a3 firmware · CWE-287 | Критическая9,8 | — | 32,2 % | 18 февр. 2025 г. |
36Наблюдать | CVE-2024-57046Proof of concept | A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the autnetgear · dgn2200 firmware · CWE-287 | Высокая8,8 | — | 2,1 % | 18 февр. 2025 г. |
21Наблюдать | CVE-2024-56882Proof of concept | Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS).sagedpw · sage dpw · CWE-79 | Средняя5,4 | — | 0,4 % | 18 февр. 2025 г. |
32Наблюдать | CVE-2024-56883Proof of concept | Sage DPW before 2024_12_001 is vulnerable to Incorrect Access Control.sagedpw · sage dpw · CWE-284 | Высокая8,1 | — | 0,7 % | 18 февр. 2025 г. |
29Наблюдать | CVE-2025-26465Proof of concept | Openssh: machine-in-the-middle attack if verifyhostkeydns is enabledopenbsd · openssh · CWE-390 | Средняя6,8 | — | 7,7 % | 18 февр. 2025 г. |
30Наблюдать | CVE-2024-13489Proof of concept | LTL Freight Quotes – Old Dominion Edition <= 4.2.10 - Unauthenticated SQL Injectioneniture · ltl freight quotes · CWE-89 | Высокая7,5 | — | 0,7 % | 19 февр. 2025 г. |
30Наблюдать | CVE-2024-13478Proof of concept | LTL Freight Quotes – TForce Edition <= 3.6.4 - Unauthenticated SQL Injectioneniture · ltl freight quotes · CWE-89 | Высокая7,5 | — | 1,2 % | 19 февр. 2025 г. |
30Наблюдать | CVE-2024-13479Proof of concept | LTL Freight Quotes – SEFL Edition <= 3.2.4 - Unauthenticated SQL Injectioneniture · ltl freight quotes · CWE-89 | Высокая7,5 | — | 0,7 % | 19 февр. 2025 г. |
30Наблюдать | CVE-2024-13481Proof of concept | LTL Freight Quotes – R+L Carriers Edition <= 3.3.4 - Unauthenticated SQL Injectioneniture · ltl freight quotes · CWE-89 | Высокая7,5 | — | 0,9 % | 19 февр. 2025 г. |
30Наблюдать | CVE-2024-13483Proof of concept | LTL Freight Quotes – SAIA Edition <= 2.2.10 - Unauthenticated SQL Injectioneniture · ltl freight quotes · CWE-89 | Высокая7,5 | — | 0,7 % | 19 февр. 2025 г. |
30Наблюдать | CVE-2024-13485Proof of concept | LTL Freight Quotes – ABF Freight Edition <= 3.3.7 - Unauthenticated SQL Injectioneniture · ltl freight quotes · CWE-89 | Высокая7,5 | — | 1,0 % | 19 февр. 2025 г. |
69На этой неделе | CVE-2025-24989Готовый эксплойт | Microsoft Power Pages Elevation of Privilege Vulnerabilitymicrosoft · power pages · CWE-284 | Критическая9,8 | KEV | 1,6 % | 19 февр. 2025 г. |
39Наблюдать | CVE-2024-12284Эксплойта нет | Authenticated privilege escalationcitrix · netscaler agent · CWE-269 | Высокая8,8 | — | 13,3 % | 19 февр. 2025 г. |
60На этой неделе | CVE-2025-27218Готовый эксплойт | Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserializaCWE-94 | Средняя5,3 | — | 65,0 % | 20 февр. 2025 г. |
24Наблюдать | CVE-2024-13888Proof of concept | WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameteramauri · wpmobile.app · CWE-601 | Средняя6,1 | — | 0,7 % | 20 февр. 2025 г. |
42В плане | CVE-2025-0868Proof of concept | Remote Code Execution in DocsGPTarc53 · docsgpt · CWE-95 | Критическая9,3 | — | 17,0 % | 20 февр. 2025 г. |
27Наблюдать | CVE-2024-55457Proof of concept | MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService.CWE-22 | Средняя6,5 | — | 3,1 % | 20 февр. 2025 г. |
24Наблюдать | CVE-2025-25968Proof of concept | DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability.ddsn · cm3 acora content management system · CWE-284 | Средняя6,0 | — | 0,9 % | 20 февр. 2025 г. |
99Срочно | CVE-2025-24893Готовый эксплойт | Remote code execution as guest via SolrSearchMacros request in xwikixwiki · xwiki · CWE-95 | Критическая9,8 | KEV | 99,9 % | 20 февр. 2025 г. |
40В плане | CVE-2024-54756Proof of concept | A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code CWE-94 | Критическая9,8 | — | 3,0 % | 20 февр. 2025 г. |
21Наблюдать | CVE-2025-1489Proof of concept | WP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcodetchgdns · wp-appbox · CWE-79 | Средняя5,4 | — | 0,3 % | 21 февр. 2025 г. |
62На этой неделе | CVE-2025-26794Proof of concept | Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.exim · exim · CWE-89 | Критическая9,8 | — | 77,4 % | 21 февр. 2025 г. |
39Наблюдать | CVE-2025-26014Proof of concept | A Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter.olajowon · loggrove · CWE-94 | Критическая9,8 | — | 1,0 % | 21 февр. 2025 г. |
48В плане | CVE-2019-8900Proof of concept | A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon apple · securerom · CWE-94 | Средняя6,8 | — | 69,5 % | 21 февр. 2025 г. |
21Наблюдать | CVE-2025-1361Proof of concept | IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Functionip2location · country blocker · CWE-285 | Средняя5,3 | — | 1,3 % | 22 февр. 2025 г. |
29Наблюдать | CVE-2024-13869Proof of concept | Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_filewpvivid · wpvivid backup \& migration · CWE-434 | Высокая7,2 | — | 2,2 % | 22 февр. 2025 г. |
27Наблюдать | CVE-2025-1595Proof of concept | Anhui Xufan Information Technology EasyCVR getbaseconfig information disclosureanhui xufan information technology · easycvr · CWE-200 | Средняя6,9 | — | 1,1 % | 23 февр. 2025 г. |
24Наблюдать | CVE-2025-1608Эксплойта нет | LB-LINK AC1900 Router set_manpwd websGetVar os command injectionlb-link · ac1900 firmware · CWE-77 | Средняя5,3 | — | 10,1 % | 23 февр. 2025 г. |
24Наблюдать | CVE-2025-1609Эксплойта нет | LB-LINK AC1900 Router set_cmd websGetVar os command injectionlb-link · ac1900 firmware · CWE-77 | Средняя5,3 | — | 10,1 % | 23 февр. 2025 г. |
25Наблюдать | CVE-2025-1610Эксплойта нет | LB-LINK AC1900 Router set_blacklist websGetVar os command injectionlb-link · ac1900 firmware · CWE-77 | Средняя5,3 | — | 13,1 % | 23 февр. 2025 г. |
37Наблюдать | CVE-2025-25279Proof of concept | Arbitrary file read in Mattermost Boards via import & export board archivemattermost · mattermost server · CWE-22 | Высокая7,5 | — | 24,2 % | 24 февр. 2025 г. |
24Наблюдать | CVE-2025-0690Proof of concept | Grub2: read: integer overflow may lead to out-of-bounds writered hat · red hat enterprise linux 9 · CWE-787 | Средняя6,1 | — | 0,7 % | 24 февр. 2025 г. |
19Наблюдать | CVE-2025-25460Proof of concept | A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature.flatpress · flatpress · CWE-79 | Средняя4,8 | — | 0,5 % | 24 февр. 2025 г. |
39Наблюдать | CVE-2024-54820Proof of concept | XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page.CWE-89 | Критическая9,8 | — | 1,2 % | 24 февр. 2025 г. |
27Наблюдать | CVE-2025-27112Proof of concept | Navidrome has authentication bypass in Subsonic API with non-existent usernamenavidrome · navidrome · CWE-287 | Средняя6,9 | — | 0,9 % | 24 февр. 2025 г. |
48В плане | CVE-2025-27364Эксплойта нет | In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implantmitre · caldera · CWE-78 | Критическая10,0 | — | 25,9 % | 24 февр. 2025 г. |
24Наблюдать | CVE-2025-26529Proof of concept | Stored XSS risk in admin live logmoodle · moodle · CWE-79 | Средняя6,1 | — | 0,5 % | 24 февр. 2025 г. |
52В плане | CVE-2025-1128Эксплойта нет | Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletionwpeverest · everest forms · CWE-434 | Критическая9,8 | — | 42,4 % | 25 февр. 2025 г. |
31Наблюдать | CVE-2022-49186Proof of concept | clk: visconti: prevent array overflow in visconti_clk_register_gates()linux · linux kernel · CWE-129 | Высокая7,8 | — | 0,2 % | 26 февр. 2025 г. |
28Наблюдать | CVE-2024-10152Proof of concept | Simple Certain Time to Show Content < 1.3.1 - Reflected XSSelementengage · simple certain time to show content · CWE-79 | Высокая7,1 | — | 0,6 % | 26 февр. 2025 г. |
24Наблюдать | CVE-2024-12737Proof of concept | WP BASE Booking of Appointments, Services and Events < 5.0.0 - Reflected XSSwp-base · wp base booking of appointments\, services and events · CWE-79 | Средняя6,1 | — | 0,6 % | 26 февр. 2025 г. |
28Наблюдать | CVE-2024-12878Proof of concept | Custom Block Builder – Lazy Blocks < 3.8.3 - Reflected XSSthedevoice · lazy blocks · CWE-79 | Высокая7,1 | — | 0,6 % | 26 февр. 2025 г. |
28Наблюдать | CVE-2024-13624Proof of concept | WPMovieLibrary <= 2.1.4.8 - Reflected XSScaercam · wpmovielibrary · CWE-79 | Высокая7,1 | — | 0,6 % | 26 февр. 2025 г. |
24Наблюдать | CVE-2024-13628Proof of concept | WP Pricing Table <= 1.1 - Reflected XSScodecabin · wp pricing table · CWE-79 | Средняя6,1 | — | 0,6 % | 26 февр. 2025 г. |
24Наблюдать | CVE-2024-13630Proof of concept | News List <= 1.0 - Reflected XSSmahinsha · newsticker · CWE-79 | Средняя6,1 | — | 0,6 % | 26 февр. 2025 г. |
24Наблюдать | CVE-2024-13634Proof of concept | Post Sync <= 1.1 - Reflected XSSwphobby · post sync · CWE-79 | Средняя6,1 | — | 0,6 % | 26 февр. 2025 г. |
40В плане | CVE-2024-47051Proof of concept | Remote Code Execution & File Deletion in Asset Uploadsacquia · mautic · CWE-23 | Критическая9,9 | — | 1,7 % | 26 февр. 2025 г. |
30Наблюдать | CVE-2024-47053Эксплойта нет | Improper Authorization in Reporting APIacquia · mautic · CWE-285 | Высокая7,7 | — | 0,7 % | 26 февр. 2025 г. |
22Наблюдать | CVE-2025-1716Proof of concept | picklescan - Security scanning bypass via 'pip main'mmaitre314 · picklescan · CWE-184 | Средняя5,3 | — | 1,7 % | 26 февр. 2025 г. |
39Наблюдать | CVE-2024-57040Proof of concept | TP-Link TL-WR845N devices with firmware TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to contain a hardcoded password ftp-link · tl-wr845n firmware · CWE-798 | Критическая9,8 | — | 1,1 % | 26 февр. 2025 г. |
31Наблюдать | CVE-2025-21756Proof of concept | vsock: Keep the binding until socket destructionlinux · linux kernel · CWE-416 | Высокая7,8 | — | 0,8 % | 27 февр. 2025 г. |
27Наблюдать | CVE-2025-21758Эксплойта нет | ipv6: mcast: add RCU protection to mld_newpack()linux · linux kernel | Средняя5,5 | — | 16,9 % | 27 февр. 2025 г. |
43В плане | CVE-2025-21760Эксплойта нет | ndisc: extend RCU protection in ndisc_send_skb()linux · linux kernel · CWE-416 | Высокая8,1 | — | 37,9 % | 27 февр. 2025 г. |
24Наблюдать | CVE-2025-1738Proof of concept | Multiple vulnerabilities in Trivision Camera NC227WFtrivision · camera nc227wf · CWE-598 | Средняя6,2 | — | 0,1 % | 27 февр. 2025 г. |
28Наблюдать | CVE-2025-1739Proof of concept | Multiple vulnerabilities in Trivision Camera NC227WFtrivision · camera nc227wf · CWE-288 | Высокая7,1 | — | 0,3 % | 27 февр. 2025 г. |
27Наблюдать | CVE-2025-1743Proof of concept | zyx0814 Pichome index.php path traversalzyx0814 · pichome · CWE-22 | Средняя6,9 | — | 1,6 % | 27 февр. 2025 г. |
51В плане | CVE-2024-53944Эксплойта нет | An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through M762CWE-94 | Критическая9,8 | — | 39,6 % | 27 февр. 2025 г. |
40В плане | CVE-2025-22952Proof of concept | elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can beusememos · memos · CWE-918 | Критическая9,8 | — | 2,9 % | 27 февр. 2025 г. |
40В плане | CVE-2025-25570Proof of concept | Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.CWE-522 | Критическая9,8 | — | 2,0 % | 27 февр. 2025 г. |
42В плане | CVE-2025-26264Proof of concept | GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its NotifiCWE-94 | Высокая8,8 | — | 23,7 % | 27 февр. 2025 г. |
40В плане | CVE-2024-8425Proof of concept | WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Uploadwpswings · woocommerce ultimate gift card · CWE-434 | Критическая9,8 | — | 4,0 % | 28 февр. 2025 г. |
40В плане | CVE-2024-9193Proof of concept | WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Updatewhmpress · whmcs · CWE-98 | Критическая9,8 | — | 3,2 % | 28 февр. 2025 г. |
36Наблюдать | CVE-2025-26326Proof of concept | A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which aCWE-287 | Высокая8,8 | — | 1,6 % | 28 февр. 2025 г. |
21Наблюдать | CVE-2025-25461Proof of concept | A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29.seeddms · seeddms · CWE-79 | Средняя5,4 | — | 0,5 % | 28 февр. 2025 г. |
20Наблюдать | CVE-2025-26263Proof of concept | GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure dCWE-200 | Средняя5,1 | — | 1,3 % | 28 февр. 2025 г. |
27Наблюдать | CVE-2025-27410Proof of concept | PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as adminpwndoc project · pwndoc · CWE-22 | Средняя6,5 | — | 2,1 % | 28 февр. 2025 г. |
35Наблюдать | CVE-2025-26466Proof of concept | Openssh: denial-of-service in opensshopenbsd · openssh · CWE-770 | Средняя5,9 | — | 38,6 % | 28 февр. 2025 г. |
- CVE-2024-1201330Наблюдать
A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h.
ВысокаяCVSS 7,6Эксплойта нетEPSS 0 %zettler · 130.800513 февр. 2025 г.
- CVE-2024-5737829Наблюдать
Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability.
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %13 февр. 2025 г.
- CVE-2025-2289660На этой неделе
mySCADA myPRO Manager Cleartext Storage of Sensitive Information
КритическаяCVSS 9,2Готовый эксплойтEPSS 3 %myscada · mypro13 февр. 2025 г.
- CVE-2025-2486560На этой неделе
mySCADA myPRO Manager Missing Authentication for Critical Function
КритическаяCVSS 10,0Готовый эксплойтEPSS 7 %myscada · mypro13 февр. 2025 г.
- CVE-2024-5495121Наблюдать
Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS).
СредняяCVSS 5,4Proof of conceptEPSS 0 %monicahq · monica13 февр. 2025 г.
- CVE-2025-2678833Наблюдать
StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.
ВысокаяCVSS 8,4Proof of conceptEPSS 0 %strongkey · fido server14 февр. 2025 г.
- CVE-2024-5772528Наблюдать
An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value without authentication,
СредняяCVSS 6,5Proof of conceptEPSS 6 %14 февр. 2025 г.
- CVE-2024-5777835Наблюдать
An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from st
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %14 февр. 2025 г.
- CVE-2025-2529625Наблюдать
Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint
СредняяCVSS 6,1Proof of conceptEPSS 1 %humansignal · label studio14 февр. 2025 г.
- CVE-2025-130238Наблюдать
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.
ВысокаяCVSS 8,9Proof of conceptEPSS 10 %15 февр. 2025 г.
- CVE-2024-1351339Наблюдать
Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation
КритическаяCVSS 9,8Proof of conceptEPSS 0 %oliverpos · oliver pos15 февр. 2025 г.
- CVE-2024-1348830Наблюдать
LTL Freight Quotes – Estes Edition <= 3.3.7 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %enituretechnology · ltl freight quotes15 февр. 2025 г.
- CVE-2025-2679338Наблюдать
The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (usern
КритическаяCVSS 9,3Proof of conceptEPSS 2 %hirsch · enterphone mesh15 февр. 2025 г.
- CVE-2025-133720Наблюдать
Eastnets PaymentSafe BIC Search cross site scripting
СредняяCVSS 5,1Proof of conceptEPSS 0 %eastnets · paymentsafe16 февр. 2025 г.
- CVE-2025-133842В плане
NUUO Camera handle_config.php print_file command injection
СредняяCVSS 6,9Proof of conceptEPSS 51 %nuuo · camera16 февр. 2025 г.
- CVE-2025-134039Наблюдать
TOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflow
ВысокаяCVSS 8,7Эксплойта нетEPSS 16 %totolink · x18 firmware16 февр. 2025 г.
- CVE-2025-092424Наблюдать
WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting
СредняяCVSS 6,1Proof of conceptEPSS 1 %melapress · wp activity log17 февр. 2025 г.
- CVE-2024-1362528Наблюдать
Tube Video Ads Lite <= 1.5.7 - Reflected XSS
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %gualdoni · tube video ads lite17 февр. 2025 г.
- CVE-2024-1362718Наблюдать
WP Touch Slider <= 2.2 - Reflected XSS
СредняяCVSS 4,7Proof of conceptEPSS 0 %wp-buy · owl carousel slider17 февр. 2025 г.
- CVE-2024-1372635Наблюдать
Themes Coder <= 1.3.4 - Unauthenticated SQLi
ВысокаяCVSS 8,6Proof of conceptEPSS 1 %themescoder · themes coder17 февр. 2025 г.
- CVE-2024-1360923Наблюдать
1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backu
СредняяCVSS 5,9Proof of conceptEPSS 1 %1clickmigration · 1 click migration18 февр. 2025 г.
- CVE-2025-102338Наблюдать
SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php
КритическаяCVSS 9,3Proof of conceptEPSS 2 %churchcrm · churchcrm18 февр. 2025 г.
- CVE-2025-103525Наблюдать
Path Traversal in Komtera Technolgies' KLog Server
СредняяCVSS 5,7Proof of conceptEPSS 9 %komtera technolgies · klog server18 февр. 2025 г.
- CVE-2024-5704549В плане
A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authen
КритическаяCVSS 9,8Proof of conceptEPSS 32 %dlink · dir-859 a3 firmware18 февр. 2025 г.
- CVE-2024-5704636Наблюдать
A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the aut
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %netgear · dgn2200 firmware18 февр. 2025 г.
- CVE-2024-5688221Наблюдать
Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS).
СредняяCVSS 5,4Proof of conceptEPSS 0 %sagedpw · sage dpw18 февр. 2025 г.
- CVE-2024-5688332Наблюдать
Sage DPW before 2024_12_001 is vulnerable to Incorrect Access Control.
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %sagedpw · sage dpw18 февр. 2025 г.
- CVE-2025-2646529Наблюдать
Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
СредняяCVSS 6,8Proof of conceptEPSS 7 %openbsd · openssh18 февр. 2025 г.
- CVE-2024-1348930Наблюдать
LTL Freight Quotes – Old Dominion Edition <= 4.2.10 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %eniture · ltl freight quotes19 февр. 2025 г.
- CVE-2024-1347830Наблюдать
LTL Freight Quotes – TForce Edition <= 3.6.4 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %eniture · ltl freight quotes19 февр. 2025 г.
- CVE-2024-1347930Наблюдать
LTL Freight Quotes – SEFL Edition <= 3.2.4 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %eniture · ltl freight quotes19 февр. 2025 г.
- CVE-2024-1348130Наблюдать
LTL Freight Quotes – R+L Carriers Edition <= 3.3.4 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %eniture · ltl freight quotes19 февр. 2025 г.
- CVE-2024-1348330Наблюдать
LTL Freight Quotes – SAIA Edition <= 2.2.10 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %eniture · ltl freight quotes19 февр. 2025 г.
- CVE-2024-1348530Наблюдать
LTL Freight Quotes – ABF Freight Edition <= 3.3.7 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %eniture · ltl freight quotes19 февр. 2025 г.
- CVE-2025-2498969На этой неделе
Microsoft Power Pages Elevation of Privilege Vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 1 %microsoft · power pages19 февр. 2025 г.
- CVE-2024-1228439Наблюдать
Authenticated privilege escalation
ВысокаяCVSS 8,8Эксплойта нетEPSS 13 %citrix · netscaler agent19 февр. 2025 г.
- CVE-2025-2721860На этой неделе
Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserializa
СредняяCVSS 5,3Готовый эксплойтEPSS 65 %20 февр. 2025 г.
- CVE-2024-1388824Наблюдать
WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter
СредняяCVSS 6,1Proof of conceptEPSS 0 %amauri · wpmobile.app20 февр. 2025 г.
- CVE-2025-086842В плане
Remote Code Execution in DocsGPT
КритическаяCVSS 9,3Proof of conceptEPSS 17 %arc53 · docsgpt20 февр. 2025 г.
- CVE-2024-5545727Наблюдать
MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService.
СредняяCVSS 6,5Proof of conceptEPSS 3 %20 февр. 2025 г.
- CVE-2025-2596824Наблюдать
DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability.
СредняяCVSS 6,0Proof of conceptEPSS 0 %ddsn · cm3 acora content management system20 февр. 2025 г.
- CVE-2025-2489399Срочно
Remote code execution as guest via SolrSearchMacros request in xwiki
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %xwiki · xwiki20 февр. 2025 г.
- CVE-2024-5475640В плане
A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code
КритическаяCVSS 9,8Proof of conceptEPSS 3 %20 февр. 2025 г.
- CVE-2025-148921Наблюдать
WP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode
СредняяCVSS 5,4Proof of conceptEPSS 0 %tchgdns · wp-appbox21 февр. 2025 г.
- CVE-2025-2679462На этой неделе
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.
КритическаяCVSS 9,8Proof of conceptEPSS 77 %exim · exim21 февр. 2025 г.
- CVE-2025-2601439Наблюдать
A Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %olajowon · loggrove21 февр. 2025 г.
- CVE-2019-890048В плане
A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon
СредняяCVSS 6,8Proof of conceptEPSS 69 %apple · securerom21 февр. 2025 г.
- CVE-2025-136121Наблюдать
IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function
СредняяCVSS 5,3Proof of conceptEPSS 1 %ip2location · country blocker22 февр. 2025 г.
- CVE-2024-1386929Наблюдать
Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file
ВысокаяCVSS 7,2Proof of conceptEPSS 2 %wpvivid · wpvivid backup \& migration22 февр. 2025 г.
- CVE-2025-159527Наблюдать
Anhui Xufan Information Technology EasyCVR getbaseconfig information disclosure
СредняяCVSS 6,9Proof of conceptEPSS 1 %anhui xufan information technology · easycvr23 февр. 2025 г.
- CVE-2025-160824Наблюдать
LB-LINK AC1900 Router set_manpwd websGetVar os command injection
СредняяCVSS 5,3Эксплойта нетEPSS 10 %lb-link · ac1900 firmware23 февр. 2025 г.
- CVE-2025-160924Наблюдать
LB-LINK AC1900 Router set_cmd websGetVar os command injection
СредняяCVSS 5,3Эксплойта нетEPSS 10 %lb-link · ac1900 firmware23 февр. 2025 г.
- CVE-2025-161025Наблюдать
LB-LINK AC1900 Router set_blacklist websGetVar os command injection
СредняяCVSS 5,3Эксплойта нетEPSS 13 %lb-link · ac1900 firmware23 февр. 2025 г.
- CVE-2025-2527937Наблюдать
Arbitrary file read in Mattermost Boards via import & export board archive
ВысокаяCVSS 7,5Proof of conceptEPSS 24 %mattermost · mattermost server24 февр. 2025 г.
- CVE-2025-069024Наблюдать
Grub2: read: integer overflow may lead to out-of-bounds write
СредняяCVSS 6,1Proof of conceptEPSS 0 %red hat · red hat enterprise linux 924 февр. 2025 г.
- CVE-2025-2546019Наблюдать
A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature.
СредняяCVSS 4,8Proof of conceptEPSS 0 %flatpress · flatpress24 февр. 2025 г.
- CVE-2024-5482039Наблюдать
XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %24 февр. 2025 г.
- CVE-2025-2711227Наблюдать
Navidrome has authentication bypass in Subsonic API with non-existent username
СредняяCVSS 6,9Proof of conceptEPSS 0 %navidrome · navidrome24 февр. 2025 г.
- CVE-2025-2736448В плане
In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implant
КритическаяCVSS 10,0Эксплойта нетEPSS 25 %mitre · caldera24 февр. 2025 г.
- CVE-2025-2652924Наблюдать
Stored XSS risk in admin live log
СредняяCVSS 6,1Proof of conceptEPSS 0 %moodle · moodle24 февр. 2025 г.
- CVE-2025-112852В плане
Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion
КритическаяCVSS 9,8Эксплойта нетEPSS 42 %wpeverest · everest forms25 февр. 2025 г.
- CVE-2022-4918631Наблюдать
clk: visconti: prevent array overflow in visconti_clk_register_gates()
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %linux · linux kernel26 февр. 2025 г.
- CVE-2024-1015228Наблюдать
Simple Certain Time to Show Content < 1.3.1 - Reflected XSS
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %elementengage · simple certain time to show content26 февр. 2025 г.
- CVE-2024-1273724Наблюдать
WP BASE Booking of Appointments, Services and Events < 5.0.0 - Reflected XSS
СредняяCVSS 6,1Proof of conceptEPSS 0 %wp-base · wp base booking of appointments\, services and events26 февр. 2025 г.
- CVE-2024-1287828Наблюдать
Custom Block Builder – Lazy Blocks < 3.8.3 - Reflected XSS
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %thedevoice · lazy blocks26 февр. 2025 г.
- CVE-2024-1362428Наблюдать
WPMovieLibrary <= 2.1.4.8 - Reflected XSS
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %caercam · wpmovielibrary26 февр. 2025 г.
- CVE-2024-1362824Наблюдать
WP Pricing Table <= 1.1 - Reflected XSS
СредняяCVSS 6,1Proof of conceptEPSS 0 %codecabin · wp pricing table26 февр. 2025 г.
- CVE-2024-1363024Наблюдать
News List <= 1.0 - Reflected XSS
СредняяCVSS 6,1Proof of conceptEPSS 0 %mahinsha · newsticker26 февр. 2025 г.
- CVE-2024-1363424Наблюдать
Post Sync <= 1.1 - Reflected XSS
СредняяCVSS 6,1Proof of conceptEPSS 0 %wphobby · post sync26 февр. 2025 г.
- CVE-2024-4705140В плане
Remote Code Execution & File Deletion in Asset Uploads
КритическаяCVSS 9,9Proof of conceptEPSS 1 %acquia · mautic26 февр. 2025 г.
- CVE-2024-4705330Наблюдать
Improper Authorization in Reporting API
ВысокаяCVSS 7,7Эксплойта нетEPSS 0 %acquia · mautic26 февр. 2025 г.
- CVE-2025-171622Наблюдать
picklescan - Security scanning bypass via 'pip main'
СредняяCVSS 5,3Proof of conceptEPSS 1 %mmaitre314 · picklescan26 февр. 2025 г.
- CVE-2024-5704039Наблюдать
TP-Link TL-WR845N devices with firmware TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to contain a hardcoded password f
КритическаяCVSS 9,8Proof of conceptEPSS 1 %tp-link · tl-wr845n firmware26 февр. 2025 г.
- CVE-2025-2175631Наблюдать
vsock: Keep the binding until socket destruction
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %linux · linux kernel27 февр. 2025 г.
- CVE-2025-2175827Наблюдать
ipv6: mcast: add RCU protection to mld_newpack()
СредняяCVSS 5,5Эксплойта нетEPSS 16 %linux · linux kernel27 февр. 2025 г.
- CVE-2025-2176043В плане
ndisc: extend RCU protection in ndisc_send_skb()
ВысокаяCVSS 8,1Эксплойта нетEPSS 37 %linux · linux kernel27 февр. 2025 г.
- CVE-2025-173824Наблюдать
Multiple vulnerabilities in Trivision Camera NC227WF
СредняяCVSS 6,2Proof of conceptEPSS 0 %trivision · camera nc227wf27 февр. 2025 г.
- CVE-2025-173928Наблюдать
Multiple vulnerabilities in Trivision Camera NC227WF
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %trivision · camera nc227wf27 февр. 2025 г.
- CVE-2025-174327Наблюдать
zyx0814 Pichome index.php path traversal
СредняяCVSS 6,9Proof of conceptEPSS 1 %zyx0814 · pichome27 февр. 2025 г.
- CVE-2024-5394451В плане
An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through M762
КритическаяCVSS 9,8Эксплойта нетEPSS 39 %27 февр. 2025 г.
- CVE-2025-2295240В плане
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be
КритическаяCVSS 9,8Proof of conceptEPSS 2 %usememos · memos27 февр. 2025 г.
- CVE-2025-2557040В плане
Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.
КритическаяCVSS 9,8Proof of conceptEPSS 2 %27 февр. 2025 г.
- CVE-2025-2626442В плане
GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its Notifi
ВысокаяCVSS 8,8Proof of conceptEPSS 23 %27 февр. 2025 г.
- CVE-2024-842540В плане
WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload
КритическаяCVSS 9,8Proof of conceptEPSS 4 %wpswings · woocommerce ultimate gift card28 февр. 2025 г.
- CVE-2024-919340В плане
WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update
КритическаяCVSS 9,8Proof of conceptEPSS 3 %whmpress · whmcs28 февр. 2025 г.
- CVE-2025-2632636Наблюдать
A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which a
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %28 февр. 2025 г.
- CVE-2025-2546121Наблюдать
A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29.
СредняяCVSS 5,4Proof of conceptEPSS 0 %seeddms · seeddms28 февр. 2025 г.
- CVE-2025-2626320Наблюдать
GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure d
СредняяCVSS 5,1Proof of conceptEPSS 1 %28 февр. 2025 г.
- CVE-2025-2741027Наблюдать
PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin
СредняяCVSS 6,5Proof of conceptEPSS 2 %pwndoc project · pwndoc28 февр. 2025 г.
- CVE-2025-2646635Наблюдать
Openssh: denial-of-service in openssh
СредняяCVSS 5,9Proof of conceptEPSS 38 %openbsd · openssh28 февр. 2025 г.