CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- lexicataLexicata <= 1.0.16 - Reflected Cross-Site Scripting6.1 Medium
- nicheaddons education addon for elementor, education addon +1 moreEducation Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode4.3 Medium
- bin-co pollinPollin <= 1.01.1 - Reflected Cross-Site Scripting6.1 Medium
- yayforms yay! formsYay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- pepro peprodev ultimate invoice, peprodev ultimate invoice +1 morePeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure5.3 Medium
- giuliopanda adfo – custom data in admin dashboardADFO – Custom data in admin dashboard <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bin-co pollinPollin <= 1.01.1 - Authenticated (Admin+) SQL Injection4.9 Medium
- johnnya23 youtube playlists with schemaYouTube Playlists with Schema <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- de-baat wp media category managementWP Media Category Management 2.0 - 2.3.3 - Cross-Site Request Forgery to Settings Update6.5 Medium
- markodonnell coaching staffsCoaching Staffs <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- iniparserHeap Overflow in iniparser.c5.1 Medium
- averta master sliderMaster Slider < 3.10.5 - Editor+ Stored XSS3.5 Low
- six apart ltd. movable type (8.0.x series), movable type (8.4.x series), movable type advanced (8.0.x series) +5 more +7 moreMovable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT...5.4 Medium
- six apart ltd. movable type (8.0.x series), movable type (8.4.x series), movable type advanced (8.0.x series) +5 more +7 moreMovable Type contains a reflected cross-site scripting vulnerability in the user information edit...6.1 Medium
- six apart ltd. movable type (8.0.x series), movable type (8.4.x series), movable type advanced (8.0.x series) +5 more +7 moreMovable Type contains a stored cross-site scripting vulnerability in the custom block edit page...5.4 Medium
- deepakkite file sharing & download manager – user private filesUser Private Files – File Upload & Download Manager with Secure File Sharing <= 2.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- themeisle visualizer: tables and charts manager for wordpressVisualizer: Tables and Charts Manager for WordPress <= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From File6.4 Medium
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting6.1 Medium
- age checker verificationAge Verification - Reflected cross-site scripting (XSS)4.3 Medium
- easypromosapp easypromos pluginEasypromos Plugin <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- wedevs subscribe2 – form, email subscribers & newslettersSubscribe2 – Form, Email Subscribers & Newsletters <= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP Parameter7.2 High
- synway smg gateway management softwareSynway SMG Gateway Management Software 9-12ping.php command injection6.9 Medium
- kasuganosoras pigeonkasuganosoras Pigeon index.php server-side request forgery5.3 Medium
- axiosys bento4An issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp,...5.5 Medium
- axiosys bento4An issue in Bento4 v1.6.0-641 allows an attacker to cause a memory leak via Ap4Marlin.cpp and...5.5 Medium
- axiosys bento4An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the...6.5 Medium
- axiosys bento4Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary...7.3 High
- axiosys bento4Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary...7.8 High
- axiosys bento4An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the...6.5 Medium
- bareboxIn barebox before 2025.01.0, ext4fs_read_symlink has an integer overflow for zalloc (adding one...7.1 High
- bareboxIn barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related...7.1 High
- No product listedPHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting ...5.4 Medium
- phpjabbers event ticketing systemPHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple HTML Injection in the "lid, name...6.1 Medium
- phpjabbers hotel booking systemPHPJabbers Hotel Booking System v4.0 is vulnerable to CSV Injection vulnerability which allows an...8.8 High
- phpjabbers hotel booking systemA lack of rate limiting in the "Login Section, Forgot Email" feature of PHPJabbers Hotel Booking...7.5 High
- phpjabbers hotel booking systemPHPJabbers Hotel Booking System v4.0 is vulnerable to Cross-Site Scripting (XSS) vulnerabilities...6.1 Medium
- phpjabbers hotel booking systemPHPJabbers Hotel Booking System v4.0 is vulnerable to HTML Injection in the "name,...6.1 Medium
- phpjabbers event booking calendarPHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection vulnerability which allows...4.7 Medium
- phpjabbers hotel booking systemA lack of rate limiting in the 'Email Settings' feature of PHPJabbers Hotel Booking System v4.0...6.5 Medium
- phpjabbers event booking calendarPHPJabbers Event Booking Calendar v4.0 is vulnerable to Cross-Site Scripting (XSS) in the "name,...6.1 Medium
- phpjabbers event booking calendarA lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Event...7.5 High
- No product listedBuffer Overflow vulnerability in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4...8.8 High
- No product listedExtreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has a buffer...9.8 Critical
- No product listedLexmark MX6500 LW75.JD.P296 and previous devices have Incorrect Access Control via the access...9.1 Critical
- No product listedCertain Lexmark products through 2020-05-25 allow XSS which allows an attacker to obtain session...6.1 Medium
- No product listedVarious Lexmark devices have CSRF that allows an attacker to modify the configuration of the device.8.1 High
- masaakitanaka booking packageBooking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter6.1 Medium
- pbatard rufusLocal Privilege Escalation in Rufus 4.6 and previous versions6.8 Medium
- wonderplugin wonder video embedWonder Video Embed <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- labredescefetrj wegiaSQL Injection endpoint 'deletar_cargo.php' parameter 'id_cargo' in WeGIA9.4 Critical
- Show moreLoading…