CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- jakob42 reaction buttonsReaction Buttons <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting5.5 Medium
- labibahmed42 team builder – meet the team, webdevocean team builder +1 moreTeam Builder – Meet the Team <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update4.3 Medium
- softdiscover zigaform, zigaform – form builder lite +1 moreZigaform – Form Builder Lite <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- marcoingraiti actionwear products syncActionwear products sync <= 2.3.2 - Unauthenticated Full Patch Disclosure5.3 Medium
- megaoptim rapid cacheRapid Cache <= 1.2.3 - Unauthenticated Cache Poisoning7.2 High
- infusionsoft keap official opt-in forms, keap official opt in forms +1 moreKeap Official Opt-in Forms <= 2.0.1 - Unauthenticated Limited Local File Inclusion9.8 Critical
- adityapatadia gumlet video, gumlet video +1 moreGumlet Video <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- homeasap easy mls listings importEasy MLS Listings Import <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- backie option editorOption Editor <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update8.8 High
- kenkwasnicki simplebooklet pdf viewer and embedder, simplebooklet, simplebooklet pdf viewer and embedder +2 moreSimplebooklet PDF Viewer and Embedder <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- catsone cats job listingsCATS Job Listings <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- byconsole wooodt lite, mdalabar wooodt lite – delivery & pickup date time location for woocommerce +1 moreWooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure5.3 Medium
- pixelgrade open hours – easy opening hours, open hours +1 moreOpen Hours – Easy Opening Hours <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- kevin-brent wprequalMortgage Lead Capture System <= 8.2.11 - Cross-Site Request Forgery to Settings Reset4.3 Medium
- platcom wp-asambleasWP-Asambleas <= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- shubhamgrover7256 resetReset <= 1.6 - Cross-Site Request Forgery to Database Reset8.1 High
- modalsurvey simple signup formSimple Signup Form <= 1.6.5 - Authenticated (Contributor+) SQL Injection6.5 Medium
- formassembly wp-formassemblyWP-FormAssembly <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- mlcalc mortgage calculator / loan calculator, mortgage loan calculator +1 moreMortgage Calculator / Loan Calculator <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- infinitescript wp-bibtexWP-BibTeX <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bigbuy dropshipping connector for woocommerce, devsmip bigbuy dropshipping connector for woocommerce +1 moreBigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path Disclosute5.3 Medium
- softdiscover zigaform, zigaform – price calculator & cost estimation form builder lite +1 moreZigaform – Price Calculator & Cost Estimation Form Builder Lite <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- supporthost simple chartsSimple Charts <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- magayo lottery resultsmagayo Lottery Results <= 2.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- openanolis anolis os, siemens ruggedcom rst2428p, scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family +17 more +19 morepam_cap: Fix potential configuration parsing error6.1 Medium
- metagauss profilegrid, profilegrid – user profiles, groups and communities +1 moreProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure4.3 Medium
- metagauss profilegrid, profilegrid – user profiles, groups and communities +1 moreProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery5.4 Medium
- luxsoft luxcal web calendar, the luxcal web calendar +1 moreThe LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version)...5.3 Medium
- luxsoft luxcal web calendar, the luxcal web calendar +1 moreThe LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version)...5.8 Medium
- luxsoft luxcal web calendar, the luxcal web calendar +1 moreThe LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version)...7.3 High
- luxsoft luxcal web calendar, the luxcal web calendar +1 moreThe LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version)...7.3 High
- gnome libxml2libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in...2.9 Low
- openbsd openssh, canonical ubuntu linux, debian linux +9 more +11 moreOpenssh: denial-of-service in openssh5.9 Medium
- openbsd openssh, debian linux, netapp active iq unified manager +15 more +17 moreOpenssh: machine-in-the-middle attack if verifyhostkeydns is enabled6.8 Medium
- webkul qloappsWebkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access...4.2 Medium
- dlink dsl-3782 firmwareA buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the destination,...5.7 Medium
- dlink dsl-3782 firmwareAn OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the public_type...8.0 High
- dlink dsl-3782 firmwareAn OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the samba_wg...8.0 High
- dlink dsl-3782 firmwareAn OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the inIP,...8.0 High
- dlink dsl-3782 firmwareA buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the sstartip, sendip,...5.7 Medium
- dlink dsl-3782 firmwareA buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01, triggered by the...5.7 Medium
- offis dcmtk, debian linux +1 moreA NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows...7.5 High
- offis dcmtk, debian linux +1 moreDCMTK v3.6.9+ DEV was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h.6.5 Medium
ffmpegDebian,libavUbuntu,ffmpeg-4openSUSE +2 more +4 moreFFmpeg git master before commit c08d30 was discovered to contain a NULL pointer dereference via...5.3 Medium- offis dcmtk, debian linux +1 moreA buffer overflow in DCMTK git master v3.6.9+ DEV allows attackers to cause a Denial of Service ...5.3 Medium
ffmpegAlpine,libavUbuntu +1 moreFFmpeg git master before commit fd1772 was discovered to contain a NULL pointer dereference via...4.3 Medium- ffmpegFFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component...8.8 High
- ffmpegFFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component...6.5 Medium
x264Debian,ffmpegUbuntu,libavUbuntu +2 moreInsufficient tracking and releasing of allocated used memory in libx264 git master allows...9.8 Critical- gnome libxml2, netapp active iq unified manager, h300s firmware +8 more +10 morelibxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in...7.8 High
- Show moreLoading…