CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- q-free maxtimeA CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free...9.1 Critical
- q-free maxtimeA CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in...5.3 Medium
- q-free maxtimeA CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q...9.8 Critical
- q-free maxtimeA CWE-20 "Improper Input Validation" in ldbMT.so in Q-Free MaxTime less than or equal to version...5.5 Medium
- q-free maxtimeA CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or...4.9 Medium
- q-free maxtimeA CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free...7.2 High
- q-free maxtimeA CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or...6.5 Medium
- q-free maxtimeA CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime...7.2 High
- q-free maxtimeA CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to...4.9 Medium
- q-free maxtimeA CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal...6.5 Medium
- q-free maxtimeA CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal...4.9 Medium
- q-free maxtimeA CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q...4.9 Medium
- q-free maxtimeA CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or...7.2 High
- linux, linux kernel +1 moredrm/v3d: Ensure job pointer is set to NULL after job completion7.8 High
- q-free maxtimeA CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"...5.5 Medium
- linux, linux kernel +1 moremm: clear uffd-wp PTE/PMD state on mremap()5.5 Medium
- linux, linux kernel +1 moreplatform/x86: dell-uart-backlight: fix serdev race4.7 Medium
- linux, linux kernel, siemens ruggedcom rst2428p +6 more +8 morefs/proc: fix softlockup in __read_vmcore (part 2)5.5 Medium
- linux, linux kernel, siemens ruggedcom rst2428p +3 more +5 morehrtimers: Handle CPU state correctly on hotplug7.8 High
- q-free maxtimeA CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free...9.8 Critical
- q-free maxtimeA CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"...5.5 Medium
- q-free maxtimeA CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free...9.8 Critical
- q-free maxtimeA CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q...9.8 Critical
- q-free maxtimeA CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than...8.1 High
- q-free maxtimeA CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q...9.8 Critical
- q-free maxtimeA CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q...9.8 Critical
- q-free maxtimeA CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or...8.8 High
- q-free maxtimeA CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free...9.8 Critical
- q-free maxtimeA CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or...5.5 Medium
- q-free maxtimeA CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or...5.3 Medium
- q-free maxtimeA CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal...9.8 Critical
- mayurik best church management softwareSourceCodester Best Church Management Software role_crud.php sql injection5.3 Medium
- code-projects real estate property management systemcode-projects Real Estate Property Management System load_user-profile.php sql injection5.3 Medium
- brizy, themefusecom brizy – page builder +1 moreBrizy – Page Builder <= 2.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- code-projects real estate property management systemcode-projects Real Estate Property Management System search.php cross site scripting5.1 Medium
- code-projects real estate property management systemcode-projects Real Estate Property Management System EditCategory cross site scripting5.1 Medium
- eniture small package quotes, enituretechnology small package quotes – purolator edition +1 moreSmall Package Quotes – Purolator Edition <= 3.6.4 - Unauthenticated SQL Injection7.5 High
- eniture ltl freight quotes, enituretechnology ltl freight quotes – for customers of fedex freight +1 moreLTL Freight Quotes – For Customers of FedEx Freight <= 3.4.1 - Unauthenticated SQL Injection7.5 High
- kevon adonis wp abstractsWP Abstracts <= 2.7.3 - Cross-Site Request Forgery to Arbitrary Account Deletion8.1 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter7.2 High
- eniture ltl freight quotes, enituretechnology ltl freight quotes – unishippers edition +1 moreLTL Freight Quotes – Unishippers Edition <= 2.5.8 - Unauthenticated SQL Injection7.5 High
- brizy, themefusecom brizy – page builder +1 moreBrizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads9.9 Critical
- janobe multi restaurant table reservation systemSourceCodester Multi Restaurant Table Reservation System select-menu.php sql injection5.3 Medium
- prestashopCross-Site Scripting (XSS) vulnerability in Prestashop4.8 Medium
- janobe multi restaurant table reservation systemSourceCodester Multi Restaurant Table Reservation System approve-reject.php sql injection5.3 Medium
- anisha job recruitmentcode-projects Job Recruitment load_user-profile.php cross site scripting5.1 Medium
- apache fineractApache Fineract: SQL injection vulnerabilities in offices API endpoint9.4 Critical
- 1000 projects attendance tracking management system1000 Projects Attendance Tracking Management System chart1.php sql injection5.3 Medium
- enituretechnology shipengine shipping quotesShipEngine Shipping Quotes <= 1.0.7 - Unauthenticated SQL Injection7.5 High
- apustheme apus framework, apusthemes superio +1 moreApus Framework <= 2.4 - Authenticated (Subscriber+) Arbitrary Options Update in import_page_options8.8 High
- Show moreLoading…