CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- apollo13 rife elementor extensions \& templates, apollo13themes rife extensions & templates for elementor +1 moreRife Elementor Extensions & Templates <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Shortcode6.4 Medium
- pickplugins comboblocks, post grid +1 morePost Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation5.3 Medium
- grafreak pago por redsys, payment by redsys +1 morePago por Redsys <= 1.0.12 - Reflected Cross-Site Scripting6.1 Medium
- svenl77 post form – registration form – profile form for user profiles – frontend content forms for user submissions (ugc), themekraft buddyforms +1 moreFrontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode6.4 Medium
- enituretechnology ltl freight quotes – purolator editionLTL Freight Quotes – Purolator Edition <= 2.2.3 - Unauthenticated SQL Injection7.5 High
- keesiemeijer custom post type date archivesCustom Post Type Date Archives <= 2.7.1 - Missing Authorization to Unauthenticated Arbitrary Shortcode Execution7.3 High
- misterpah mambo importer, mambo joomla importer +1 moreMambo Importer <= 1.0 - Authenticated (Administrator+) PHP Object Injection7.2 High
- versluis show me the cookiesShow Me The Cookies <= 1.0 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- wpjobportal wp job portal, wp job portal – ai-powered recruitment system for company or job board website +1 moreWP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection4.3 Medium
- ibm watson query on cloud pak for data, watson query with cloud pak for data +1 moreIBM Watson Query on Cloud Pak for Data information disclosure5.3 Medium
ndpiOSS-FuzzUNKNOWN WRITE in ndpi_free_flow_dataNo scorendpiOSS-FuzzHeap-buffer-overflow in ___interceptor_strncatNo scoreleantime/leantimePackagistLeantime allows Cross-Site Scripting (XSS)2.1 Low- leantimeLeantime affected by Improper Neutralization of HTML Tags5.4 Medium
leantime/leantimePackagistLeantime has Missing Authorization Check for Host Parameter2.3 Low- ibm security verify bridge directory sync, security verify gateway for radius, security verify gateway for windows login +2 moreIBM Security Verify Bridge information disclosure3.3 Low
leantime/leantimePackagistLeantime allows Stored Cross-Site Scripting (XSS)7.6 Highleantime/leantimePackagistLeantime allows Cross-Site Request Forgery (CSRF)5.9 Mediumleantime/leantimePackagistLeantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)7.4 Highleantime/leantimePackagistLeantime allows Stored Cross-Site Scripting (XSS)5.9 Mediumleantime/leantimePackagistLeantime allows Refelected Cross-Site Scripting (XSS)5.9 Mediumleantime/leantimePackagistLeantime has Insufficiently Protected Credentials5.7 Mediumleantime/leantimePackagistLeantime allows Stored Cross-Site Scripting (XSS)5.1 Mediumleantime/leantimePackagistLeantime has Host Header Injection Vulnerability6.5 Medium- vyperlang vypersqrt doesn't define rounding behavior in Vyper2.3 Low
- vyperlang vyperdouble eval in For List Iter in Vyper2.3 Low
- vyperlang vyperAugAssign evaluation order causing OOB write within the object in Vyper2.3 Low
- chrisleekr binance-trading-botCode injection in binance-trading-bot7.7 High
- apple secureromA vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated...6.8 Medium
- solidjs solidLack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-js7.3 High
- ryansolid dom-expressions, dom expressions +1 moreCross-site Scripting vulnerability due to improper use of string.replace in dom-expressions7.3 High
- infiniflow ragflowPotential Insecure Direct Object Reference (IDOR) vulnerability in ragflow8.1 High
- hzmanyun education and training systemhzmanyun Education and Training System saveImage unrestricted upload6.9 Medium
- iteachyou dreamer cmsiteachyou Dreamer CMS edit cross site scripting5.1 Medium
- ibm qiskit, qiskit sdk +1 moreQiskit SDK denial of service8.6 High
- ibm security verify bridge directory sync, security verify gateway for radius, security verify gateway for windows login +2 moreIBM Security Verify Bridge information disclosure5.5 Medium
- bdcom behavior management and auditing systemBDCOM Behavior Management and Auditing System operate.mds log_operate_clear os command injection6.9 Medium
- dingfanzu cmsdingfanzu CMS loadShopInfo.php sql injection5.3 Medium
- iteachyou dreamer cmsiteachyou Dreamer CMS ueditor-1.4.3.3 path traversal5.3 Medium
- d-link dap-1320, dlink dap-1320 firmware +1 moreD-Link DAP-1320 storagein.pd-XXXXXX replace_special_char stack-based overflow8.7 High
- d-link dap-1320, dlink dap-1320 firmware +1 moreD-Link DAP-1320 api set_ws_action heap-based overflow8.7 High
- harpia diagsystemHarpia DiagSystem atualatendimento_jpeg.php sql injection5.3 Medium
- raisecom multi-service intelligent gatewayRaisecom Multi-Service Intelligent Gateway Request Parameter vpn_template_style.php os command injection6.9 Medium
- abseil abseil-cpp, common libraries, debian linux +2 moreHeap Buffer overflow in Abseil5.9 Medium
- benbodhi svg supportSVG Support <= 2.5.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- No product listedOpera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The...4.7 Medium
- baiyi cloud asset management systemBaiyi Cloud Asset Management System admin.ticket.close.php sql injection6.9 Medium
resolvecrates.ioresolve is unmaintainedNo score- wyn enterprise enterpriseCode Injection in Wyn Enterprise8.7 High
- azzaroco indeed ultimate learning pro, wpindeed ultimate learning pro +1 moreIndeed Ultimate Learning Pro <= 3.9 - Authenticated (Administrator+) SQL Injection via post_id Parameter4.9 Medium
- Show moreLoading…