İçeriğe atla
Noroxi

Yayın tarihine göre

Şubat 2025: sömürülen ve yeni ciddi CVE kayıtları

189 kayıt · 15 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 2

  • CVE-2024-12013
    30İzleyin

    A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h.

    YüksekCVSS 7,6İstismar yokEPSS %0

    zettler · 130.800513 Şub 2025

  • CVE-2024-57378
    29İzleyin

    Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability.

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    13 Şub 2025

  • CVE-2025-22896
    60Bu hafta

    mySCADA myPRO Manager Cleartext Storage of Sensitive Information

    KritikCVSS 9,2SilahlaştırılmışEPSS %3

    myscada · mypro13 Şub 2025

  • CVE-2025-24865
    60Bu hafta

    mySCADA myPRO Manager Missing Authentication for Critical Function

    KritikCVSS 10,0SilahlaştırılmışEPSS %7

    myscada · mypro13 Şub 2025

  • CVE-2024-54951
    21İzleyin

    Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS).

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    monicahq · monica13 Şub 2025

  • CVE-2025-26788
    33İzleyin

    StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.

    YüksekCVSS 8,4Kavram kanıtıEPSS %0

    strongkey · fido server14 Şub 2025

  • CVE-2024-57725
    28İzleyin

    An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value without authentication,

    OrtaCVSS 6,5Kavram kanıtıEPSS %6

    14 Şub 2025

  • CVE-2024-57778
    35İzleyin

    An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from st

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    14 Şub 2025

  • CVE-2025-25296
    25İzleyin

    Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    humansignal · label studio14 Şub 2025

  • CVE-2025-1302
    38İzleyin

    Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.

    YüksekCVSS 8,9Kavram kanıtıEPSS %10

    15 Şub 2025

  • CVE-2024-13513
    39İzleyin

    Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    oliverpos · oliver pos15 Şub 2025

  • CVE-2024-13488
    30İzleyin

    LTL Freight Quotes – Estes Edition <= 3.3.7 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    enituretechnology · ltl freight quotes15 Şub 2025

  • CVE-2025-26793
    38İzleyin

    The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (usern

    KritikCVSS 9,3Kavram kanıtıEPSS %2

    hirsch · enterphone mesh15 Şub 2025

  • CVE-2025-1337
    20İzleyin

    Eastnets PaymentSafe BIC Search cross site scripting

    OrtaCVSS 5,1Kavram kanıtıEPSS %0

    eastnets · paymentsafe16 Şub 2025

  • CVE-2025-1338
    42Planlayın

    NUUO Camera handle_config.php print_file command injection

    OrtaCVSS 6,9Kavram kanıtıEPSS %51

    nuuo · camera16 Şub 2025

  • CVE-2025-1340
    39İzleyin

    TOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflow

    YüksekCVSS 8,7İstismar yokEPSS %16

    totolink · x18 firmware16 Şub 2025

  • CVE-2025-0924
    24İzleyin

    WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    melapress · wp activity log17 Şub 2025

  • CVE-2024-13625
    28İzleyin

    Tube Video Ads Lite <= 1.5.7 - Reflected XSS

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    gualdoni · tube video ads lite17 Şub 2025

  • CVE-2024-13627
    18İzleyin

    WP Touch Slider <= 2.2 - Reflected XSS

    OrtaCVSS 4,7Kavram kanıtıEPSS %0

    wp-buy · owl carousel slider17 Şub 2025

  • CVE-2024-13726
    35İzleyin

    Themes Coder <= 1.3.4 - Unauthenticated SQLi

    YüksekCVSS 8,6Kavram kanıtıEPSS %1

    themescoder · themes coder17 Şub 2025

  • CVE-2024-13609
    23İzleyin

    1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backu

    OrtaCVSS 5,9Kavram kanıtıEPSS %1

    1clickmigration · 1 click migration18 Şub 2025

  • CVE-2025-1023
    38İzleyin

    SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php

    KritikCVSS 9,3Kavram kanıtıEPSS %2

    churchcrm · churchcrm18 Şub 2025

  • CVE-2025-1035
    25İzleyin

    Path Traversal in Komtera Technolgies' KLog Server

    OrtaCVSS 5,7Kavram kanıtıEPSS %9

    komtera technolgies · klog server18 Şub 2025

  • CVE-2024-57045
    49Planlayın

    A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authen

    KritikCVSS 9,8Kavram kanıtıEPSS %32

    dlink · dir-859 a3 firmware18 Şub 2025

  • CVE-2024-57046
    36İzleyin

    A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the aut

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    netgear · dgn2200 firmware18 Şub 2025

  • CVE-2024-56882
    21İzleyin

    Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS).

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    sagedpw · sage dpw18 Şub 2025

  • CVE-2024-56883
    32İzleyin

    Sage DPW before 2024_12_001 is vulnerable to Incorrect Access Control.

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    sagedpw · sage dpw18 Şub 2025

  • CVE-2025-26465
    29İzleyin

    Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled

    OrtaCVSS 6,8Kavram kanıtıEPSS %7

    openbsd · openssh18 Şub 2025

  • CVE-2024-13489
    30İzleyin

    LTL Freight Quotes – Old Dominion Edition <= 4.2.10 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    eniture · ltl freight quotes19 Şub 2025

  • CVE-2024-13478
    30İzleyin

    LTL Freight Quotes – TForce Edition <= 3.6.4 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    eniture · ltl freight quotes19 Şub 2025

  • CVE-2024-13479
    30İzleyin

    LTL Freight Quotes – SEFL Edition <= 3.2.4 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    eniture · ltl freight quotes19 Şub 2025

  • CVE-2024-13481
    30İzleyin

    LTL Freight Quotes – R+L Carriers Edition <= 3.3.4 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    eniture · ltl freight quotes19 Şub 2025

  • CVE-2024-13483
    30İzleyin

    LTL Freight Quotes – SAIA Edition <= 2.2.10 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    eniture · ltl freight quotes19 Şub 2025

  • CVE-2024-13485
    30İzleyin

    LTL Freight Quotes – ABF Freight Edition <= 3.3.7 - Unauthenticated SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    eniture · ltl freight quotes19 Şub 2025

  • CVE-2025-24989
    69Bu hafta

    Microsoft Power Pages Elevation of Privilege Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %1

    microsoft · power pages19 Şub 2025

  • CVE-2024-12284
    39İzleyin

    Authenticated privilege escalation

    YüksekCVSS 8,8İstismar yokEPSS %13

    citrix · netscaler agent19 Şub 2025

  • CVE-2025-27218
    60Bu hafta

    Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserializa

    OrtaCVSS 5,3SilahlaştırılmışEPSS %65

    20 Şub 2025

  • CVE-2024-13888
    24İzleyin

    WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    amauri · wpmobile.app20 Şub 2025

  • CVE-2025-0868
    42Planlayın

    Remote Code Execution in DocsGPT

    KritikCVSS 9,3Kavram kanıtıEPSS %17

    arc53 · docsgpt20 Şub 2025

  • CVE-2024-55457
    27İzleyin

    MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService.

    OrtaCVSS 6,5Kavram kanıtıEPSS %3

    20 Şub 2025

  • CVE-2025-25968
    24İzleyin

    DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability.

    OrtaCVSS 6,0Kavram kanıtıEPSS %0

    ddsn · cm3 acora content management system20 Şub 2025

  • CVE-2025-24893
    99Hemen

    Remote code execution as guest via SolrSearchMacros request in xwiki

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    xwiki · xwiki20 Şub 2025

  • CVE-2024-54756
    40Planlayın

    A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    20 Şub 2025

  • CVE-2025-1489
    21İzleyin

    WP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    tchgdns · wp-appbox21 Şub 2025

  • CVE-2025-26794
    62Bu hafta

    Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.

    KritikCVSS 9,8Kavram kanıtıEPSS %77

    exim · exim21 Şub 2025

  • CVE-2025-26014
    39İzleyin

    A Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    olajowon · loggrove21 Şub 2025

  • CVE-2019-8900
    48Planlayın

    A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon

    OrtaCVSS 6,8Kavram kanıtıEPSS %68

    apple · securerom21 Şub 2025

  • CVE-2025-1361
    21İzleyin

    IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function

    OrtaCVSS 5,3Kavram kanıtıEPSS %1

    ip2location · country blocker22 Şub 2025

  • CVE-2024-13869
    29İzleyin

    Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file

    YüksekCVSS 7,2Kavram kanıtıEPSS %2

    wpvivid · wpvivid backup \& migration22 Şub 2025

  • CVE-2025-1595
    27İzleyin

    Anhui Xufan Information Technology EasyCVR getbaseconfig information disclosure

    OrtaCVSS 6,9Kavram kanıtıEPSS %1

    anhui xufan information technology · easycvr23 Şub 2025

  • CVE-2025-1608
    24İzleyin

    LB-LINK AC1900 Router set_manpwd websGetVar os command injection

    OrtaCVSS 5,3İstismar yokEPSS %10

    lb-link · ac1900 firmware23 Şub 2025

  • CVE-2025-1609
    24İzleyin

    LB-LINK AC1900 Router set_cmd websGetVar os command injection

    OrtaCVSS 5,3İstismar yokEPSS %10

    lb-link · ac1900 firmware23 Şub 2025

  • CVE-2025-1610
    25İzleyin

    LB-LINK AC1900 Router set_blacklist websGetVar os command injection

    OrtaCVSS 5,3İstismar yokEPSS %13

    lb-link · ac1900 firmware23 Şub 2025

  • CVE-2025-0690
    24İzleyin

    Grub2: read: integer overflow may lead to out-of-bounds write

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    red hat · red hat enterprise linux 924 Şub 2025

  • CVE-2025-25279
    37İzleyin

    Arbitrary file read in Mattermost Boards via import & export board archive

    YüksekCVSS 7,5Kavram kanıtıEPSS %24

    mattermost · mattermost server24 Şub 2025

  • CVE-2025-25460
    19İzleyin

    A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature.

    OrtaCVSS 4,8Kavram kanıtıEPSS %0

    flatpress · flatpress24 Şub 2025

  • CVE-2024-54820
    39İzleyin

    XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    24 Şub 2025

  • CVE-2025-27112
    27İzleyin

    Navidrome has authentication bypass in Subsonic API with non-existent username

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    navidrome · navidrome24 Şub 2025

  • CVE-2025-27364
    48Planlayın

    In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implant

    KritikCVSS 10,0İstismar yokEPSS %25

    mitre · caldera24 Şub 2025

  • CVE-2025-26529
    24İzleyin

    Stored XSS risk in admin live log

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    moodle · moodle24 Şub 2025

  • CVE-2025-1128
    52Planlayın

    Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion

    KritikCVSS 9,8İstismar yokEPSS %42

    wpeverest · everest forms25 Şub 2025

  • CVE-2022-49186
    31İzleyin

    clk: visconti: prevent array overflow in visconti_clk_register_gates()

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel26 Şub 2025

  • CVE-2024-10152
    28İzleyin

    Simple Certain Time to Show Content < 1.3.1 - Reflected XSS

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    elementengage · simple certain time to show content26 Şub 2025

  • CVE-2024-12737
    24İzleyin

    WP BASE Booking of Appointments, Services and Events < 5.0.0 - Reflected XSS

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    wp-base · wp base booking of appointments\, services and events26 Şub 2025

  • CVE-2024-12878
    28İzleyin

    Custom Block Builder – Lazy Blocks < 3.8.3 - Reflected XSS

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    thedevoice · lazy blocks26 Şub 2025

  • CVE-2024-13624
    28İzleyin

    WPMovieLibrary <= 2.1.4.8 - Reflected XSS

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    caercam · wpmovielibrary26 Şub 2025

  • CVE-2024-13628
    24İzleyin

    WP Pricing Table <= 1.1 - Reflected XSS

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    codecabin · wp pricing table26 Şub 2025

  • CVE-2024-13630
    24İzleyin

    News List <= 1.0 - Reflected XSS

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    mahinsha · newsticker26 Şub 2025

  • CVE-2024-13634
    24İzleyin

    Post Sync <= 1.1 - Reflected XSS

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    wphobby · post sync26 Şub 2025

  • CVE-2024-47051
    40Planlayın

    Remote Code Execution & File Deletion in Asset Uploads

    KritikCVSS 9,9Kavram kanıtıEPSS %1

    acquia · mautic26 Şub 2025

  • CVE-2024-47053
    30İzleyin

    Improper Authorization in Reporting API

    YüksekCVSS 7,7İstismar yokEPSS %0

    acquia · mautic26 Şub 2025

  • CVE-2025-1716
    22İzleyin

    picklescan - Security scanning bypass via 'pip main'

    OrtaCVSS 5,3Kavram kanıtıEPSS %1

    mmaitre314 · picklescan26 Şub 2025

  • CVE-2024-57040
    39İzleyin

    TP-Link TL-WR845N devices with firmware TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to contain a hardcoded password f

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    tp-link · tl-wr845n firmware26 Şub 2025

  • CVE-2025-21756
    31İzleyin

    vsock: Keep the binding until socket destruction

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel27 Şub 2025

  • CVE-2025-21758
    27İzleyin

    ipv6: mcast: add RCU protection to mld_newpack()

    OrtaCVSS 5,5İstismar yokEPSS %17

    linux · linux kernel27 Şub 2025

  • CVE-2025-21760
    43Planlayın

    ndisc: extend RCU protection in ndisc_send_skb()

    YüksekCVSS 8,1İstismar yokEPSS %37

    linux · linux kernel27 Şub 2025

  • CVE-2025-1738
    24İzleyin

    Multiple vulnerabilities in Trivision Camera NC227WF

    OrtaCVSS 6,2Kavram kanıtıEPSS %0

    trivision · camera nc227wf27 Şub 2025

  • CVE-2025-1739
    28İzleyin

    Multiple vulnerabilities in Trivision Camera NC227WF

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    trivision · camera nc227wf27 Şub 2025

  • CVE-2025-1743
    27İzleyin

    zyx0814 Pichome index.php path traversal

    OrtaCVSS 6,9Kavram kanıtıEPSS %1

    zyx0814 · pichome27 Şub 2025

  • CVE-2024-53944
    51Planlayın

    An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through M762

    KritikCVSS 9,8İstismar yokEPSS %39

    27 Şub 2025

  • CVE-2025-22952
    40Planlayın

    elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    usememos · memos27 Şub 2025

  • CVE-2025-25570
    40Planlayın

    Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    27 Şub 2025

  • CVE-2025-26264
    42Planlayın

    GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its Notifi

    YüksekCVSS 8,8Kavram kanıtıEPSS %23

    27 Şub 2025

  • CVE-2024-8425
    40Planlayın

    WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %4

    wpswings · woocommerce ultimate gift card28 Şub 2025

  • CVE-2024-9193
    40Planlayın

    WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    whmpress · whmcs28 Şub 2025

  • CVE-2025-25461
    21İzleyin

    A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29.

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    seeddms · seeddms28 Şub 2025

  • CVE-2025-26263
    20İzleyin

    GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure d

    OrtaCVSS 5,1Kavram kanıtıEPSS %1

    28 Şub 2025

  • CVE-2025-27410
    27İzleyin

    PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin

    OrtaCVSS 6,5Kavram kanıtıEPSS %2

    pwndoc project · pwndoc28 Şub 2025

  • CVE-2025-26466
    35İzleyin

    Openssh: denial-of-service in openssh

    OrtaCVSS 5,9Kavram kanıtıEPSS %40

    openbsd · openssh28 Şub 2025