Web Application Detections Published in February 2025

In February, Qualys Web Application Scanning released QIDs targeting vulnerabilities in several widely used software products and frameworks, including, Bootstrap, CKEditor, DOMPurify, jQuery, SeaCMS, Cacti, WordPress, Devika AI, YesWiki, YouDian CMS, Zimbra, Ollama, Adobe Magento, Roundcube Webmail, Flowise, Cockpit, ClassCMS, LiteLLM, Nginx UI, Backdrop CMS, Prometheus, Apache Ambari, Ivanti Cloud Services Application (CSA), Ivanti Connect Secure (ICS), GraphQL, Fortinet FortiOS, GitLab CE/EE, Progress Telerik Report Server, Trimble Cityworks, JetBrains TeamCity, Palo Alto Networks PAN-OS, Werkzeug, Apache OFBiz, Kibana, XWiki, Craft CMS, Mattermost

The QIDs released to detect the vulnerabilities in the frameworks above are listed below, details about the following QIDs can be found in our knowledge base. Please review reports of the scanned applications for these detections and, if any are identified, follow the steps provided in the knowledge base to ensure applications are protected against the reported vulnerabilities. Resolution of these vulnerabilities as soon as they are detected should be a priority for all organizations. These vulnerabilities can pose security risks if not addressed. Security risks can include breaches, unauthorized access, and various malicious activities.