CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- mattermost, mattermost server +1 moreArbitrary file read in Mattermost Boards via import & export board archive9.9 Critical
- mattermost, mattermost server +1 moreSession Persistence After User-to-Bot Conversion3.1 Low
- mattermost, mattermost server +1 moreChannel export permitted on archived channel when viewing archived channels is disabled4.3 Medium
- unknown photo contest | competition | video contest, totalsuite totalcontest +1 moreTotal Contest Lite <= 2.8.1 - Reflected XSS6.1 Medium
- 10web form maker, unknown form maker by 10web +1 moreForm Maker by 10Web < 1.15.33 - Admin+ Stored XSS4.8 Medium
- logichunt logo sliderLogo Slider < 4.6.0 - Contributor+ Stored XSS5.4 Medium
- excitel broadband private my excitel appExcitel Broadband Private my Excitel App One-Time Password excessive authentication5.1 Medium
- churchcrm crmvTiger CRM index.php cross site scripting5.3 Medium
- netis wf2780Netis WF2780 Wireless 2.4G Menu cross site scripting4.8 Medium
- fiberhome an5506-01a onu gpon, an5506-01a firmware +1 moreFiberHome AN5506-01A ONU GPON Diagnosis os command injection5.1 Medium
- fiberhome an5506-01a onu gpon, an5506-01-a firmware +1 moreFiberHome AN5506-01A ONU GPON NAT Submenu cross site scripting4.8 Medium
- fiberhome an5506-01a onu gpon, an5506-01-a firmware +1 moreFiberHome AN5506-01A ONU GPON Port Forwarding Submenu portForwardingCfg cross site scripting4.8 Medium
- fiberhome an5506-01a onu gpon, an5506-01-a firmware +1 moreFiberHome AN5506-01A ONU GPON URL Filtering Submenu URL_filterCfg cross site scripting4.8 Medium
- edimax br-6288acl, br-6288acl firmware +1 moreEdimax BR-6288ACL wireless5g_basic.asp cross site scripting5.1 Medium
- ibm iIBM i privilege escalation8.5 High
- shopxoShopXO Template ThemeAdminService.php injection5.1 Medium
- lb-link ac1900 router, ac1900 firmware +1 moreLB-LINK AC1900 Router set_blacklist websGetVar os command injection5.3 Medium
- lb-link ac1900 router, ac1900 firmware +1 moreLB-LINK AC1900 Router set_cmd websGetVar os command injection5.3 Medium
- lb-link ac1900 router, ac1900 firmware +1 moreLB-LINK AC1900 Router set_manpwd websGetVar os command injection5.3 Medium
- mayurik best employee management systemSourceCodester Best Employee Management System salary_slip.php authorization5.3 Medium
net-snmpOSS-FuzzHeap-buffer-overflow in snmp_in_optionsNo scorenet-snmpOSS-FuzzHeap-buffer-overflow in se_add_pairNo scorendpiOSS-FuzzUNKNOWN WRITE in ndpi_free_flow_dataNo score- mayurik best employee management systemSourceCodester Best Employee Management System backups.php information disclosure5.3 Medium
- mayurik best church management softwareSourceCodester Best Church Management Software profile_crud.php path traversal5.3 Medium
- mitre calderaIn MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE)...10.0 Critical
- phusion passengerPhusion Passenger denial of service5.3 Medium
- No product listedCredential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote...9.1 Critical
- slims senayan library management systemSQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month...7.2 High
- seacmsSeacms <=13.3 is vulnerable to SQL Injection in admin_members.php.9.8 Critical
- flatpressA stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the ...4.8 Medium
- workos hosted authkitWorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling...6.0 Medium
- seacmsSQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute...9.8 Critical
- sparkshopAn issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a...5.3 Medium
- No product listedAn issue in Via Browser 6.1.0 allows a a remote attacker to execute arbitrary code via the mark...6.5 Medium
- tawk tawk.toTawkTo Widget Version <= 1.3.7 is vulnerable to Cross Site Scripting (XSS) due to processing user...6.1 Medium
- yitechnology yi car dashcam firmwareImproper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file...9.8 Critical
- No product listedIn Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an...9.8 Critical
- No product listedXOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection...9.8 Critical
- No product listedNovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL...9.8 Critical
- No product listedNovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL...5.4 Medium
- No product listedIncorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme...6.5 Medium
- mayurik best church management softwareSourceCodester Best Church Management Software asset_crud.php unrestricted upload5.3 Medium
- mayurik best church management softwareSourceCodester Best Church Management Software redirect.php cross site scripting5.1 Medium
- mayurik best church management softwareSourceCodester Best Church Management Software fpassword.php sql injection6.9 Medium
- imithemes eventerWordPress Eventer - WordPress Event & Booking Manager Plugin plugin < 3.9.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- matt cromwell give – divi donation modulesWordPress Give – Divi Donation Modules plugin <= 2.0.0 - Sensitive Data Exposure vulnerability5.8 Medium
- totalsoft woocommerce pricing – product pricingWordPress WooCommerce Pricing – Product Pricing plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- vbout marketing automationWordPress Marketing Automation Plugin <= 1.2.6.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- anhui xufan information technology easycvrAnhui Xufan Information Technology EasyCVR getbaseconfig information disclosure6.9 Medium
- Show moreLoading…