CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- stellarwp event tickets and registration, theeventscalendar event tickets +1 moreEvent Tickets and Registration <= 5.19.1.1 - Missing Authorization to Ticket Deletion5.3 Medium
- saadiqbal wpexperts square for givewp, wpexperts givewp square +1 moreWPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- igumbi, smtm igumbi online booking +1 moreigumbi Online Booking <= 1.40 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- marcelismus wp-appboxWP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode6.4 Medium
- satollo head, footer and post injections, head\, footer\, and post injections +1 moreHead, Footer and Post Injections <= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments4.1 Medium
- eclipse omrEclipse OMR: Buffer overflow vulnerability7.1 High
- eclipse omrEclipse OMR: Null pointer dereference vulnerability5.1 Medium
- icopydoc maps for wpMaps for WP <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- cyberchimps responsive addons for elementor, responsive addons for elementor – free elementor addons, kits and elementor templates +1 moreResponsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Local File Inclusion8.8 High
- oliverfriedmann ziggeoZiggeo <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- patternsinthecloud autoship cloud for woocommerce subscription products, autoship cloud for woocommerce +1 moreAutoship Cloud for WooCommerce Subscription Products <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.9.2 - Authenticated SQL Injection5.3 Medium
- jonathanjernigan pie calendar, apexws pie calendar – events calendar made simple +1 moreEvents Calendar Made Simple – Pie Calendar <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piecal Shortcode6.4 Medium
- eclipse threadx netx duo, eclipse foundation threadx +1 moreEclipse ThreadX NetX Duo HTTP server single PUT request integer underflow5.3 Medium
- eclipse threadx netx duo, eclipse foundation threadx +1 moreEclipse ThreadX NetX Duo HTTP server single PUT request integer underflow5.3 Medium
- eclipse threadx netx duo, eclipse foundation threadx +1 moreEclipse ThreadX NetX Duo HTTP server denial of service7.1 High
- unknown ajax search lite, wp-dreams ajax search +1 moreAjax Search Lite < 4.12.5 - Admin+ Stored XSS3.5 Low
- unknown carousel, slider, gallery by wp carousel, techearty carousel\, slider\, gallery by wp carousel +1 moreCarousel, Slider, Gallery by WP Carousel < 2.7.4 - Admin+ Stored XSS3.5 Low
- netweblogic events manager – calendar, bookings, tickets, and more!, pixelite events manager +1 moreEvents Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter7.5 High
- labibahmed42 3d photo gallery3D Photo Gallery <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- imamura newpost catchNewpost Catch <= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via npc Shortcode6.4 Medium
- covertnine c9 blocksC9 Blocks <= 1.7.7 - Unauthenticated Full Path Disclosure5.3 Medium
- amothemo amo team showcaseAMO Team Showcase <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via amoteam_skills Shortcode6.4 Medium
- minicoursegenerator mini course generator | embed mini-courses and interactive content, mini course generator +1 moreMini Course Generator | Embed mini-courses and interactive content <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- covertnine c9 admin dashboardC9 Admin Dashboard <= 1.3.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- unknown wpupper share buttonsWPUpper Share Buttons <= 3.51 - Cross-Site Request Forgery to Custom CSS Update4.3 Medium
- genetechproducts pie register – user registration, profiles & content restriction, genetechsolutions pie register +1 moreRegistration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction <= 3.8.4 - Sensitive Information Exposure via Log Files5.3 Medium
- tcoder tcbd tooltipTCBD Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- pinpoint booking system, dotonpaper pinpoint booking system – version 2 +1 morePinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- ivanti connect secure, policy secure +1 moreExternal control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti...9.1 Critical
- medixant radiant dicom viewerMedixant RadiAnt DICOM Viewer Improper Certificate Validation5.7 Medium
- treeverse lakefsAn authenticated user can crash lakeFS by exhausting server memory6.5 Medium
- eximExim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL...7.5 High
- olajowon loggroveA Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute...9.8 Critical
- olajowon loggroveAn issue in Loggrove v.1.0 allows a remote attacker to obtain sensitive information via the read...8.2 High
- angeljudesuarez simple chatboxA vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects...3.8 Low
- angeljudesuarez simple chatboxA vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects...3.8 Low
- angeljudesuarez simple chatboxA vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects...7.2 High
- angeljudesuarez simple chatboxA vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects...6.4 Medium
- ujcms jspxcmsA Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to...5.1 Medium
- wang.market wangmarketWangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the...6.8 Medium
- wang.market wangmarketWangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the...8.0 High
- mrcmsMRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in...5.4 Medium
- mrcmsA vertical privilege escalation vulnerability in the component /controller/UserController.java of...4.8 Medium
- mrcmsAn arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows...4.8 Medium
- mrcmsMRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component ...4.0 Medium
- totolink x5000r firmwareTotolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the...6.5 Medium
- totolink x5000r firmwareTotolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable...6.5 Medium
- tenda ac8 firmwareTenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the get_parentControl_list_Info function.6.5 Medium
- tenda ac6 firmwareThere is a RCE vulnerability in Tenda AC6 15.03.05.16_multi. In the formexeCommand function, the...6.5 Medium
- Show moreLoading…