CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- ultrapressorg ultra addons lite for elementorUltra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure4.3 Medium
- iqonic kivicare, iqonicdesign kivicare – clinic & patient management system (ehr) +1 moreKiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter6.5 Medium
- exclusiveaddons exclusive addons for elementorExclusive Addons for Elementor <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison Widgets6.4 Medium
- implecode product catalog simpleProduct Catalog Simple <= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_products Shortcode6.4 Medium
- gvectors wpforo forumwpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update6.5 Medium
- roxnor wp social login and register social counterWp Social Login and Register Social Counter <= 3.1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- contest-gallery contest gallery, contest gallery – upload & vote photos, media, sell with paypal & stripe +1 morePhotos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site Scripting7.2 High
- manoj kumar mk google directionsMK Google Directions <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpeverest user registration, user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder +1 moreUser Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting6.1 Medium
- ratemyagent, ratemyagent official +1 moreRateMyAgent Official <= 1.4.0 - Cross-Site Request Forgery to API Key Update4.3 Medium
- portfoliohub wordpress portfolio builder – portfolio gallery, portfoliohub +1 moreWordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- berocket advanced ajax product filtersAdvanced AJAX Product Filters <= 1.6.8.1 - Reflected Cross-Site Scripting6.1 Medium
- pickplugins post gridPost Grid and Gutenberg Blocks – ComboBlocks <= 2.3.6 - Unauthenticated User Information Exposure5.3 Medium
- radare radare2Out-of-bounds Write in radare210.0 Critical
- ibm cognos analyticsIBM Cognos Analytics path traversal6.5 Medium
- ibm cognos analyticsIBM MQ path traversal6.5 Medium
- ibm mq, mq appliance +1 moreIBM MQ denial of service6.5 Medium
- ibm mq, mq appliance +1 moreIBM MQ information disclosure4.7 Medium
- ibm mq, mq appliance +1 moreIBM MQ code execution8.8 High
net-snmpOSS-FuzzHeap-buffer-overflow in usm_set_user_passwordNo scoreghostscriptOSS-FuzzSegv on unknown address in chunk_free_objectNo scoreghostscriptOSS-FuzzUNKNOWN READ in insert_freeNo scoreghostscriptOSS-FuzzHeap-use-after-free in gc_traceNo scoreghostscriptOSS-FuzzUNKNOWN READ in chunk_obj_allocNo score- No product listedA vulnerability in the remote connection complements of the NVDA (Nonvisual Desktop Access) 2024...8.8 High
- No product listedGeoVision ASManager Windows desktop application with the version 6.1.2.0 or less, is vulnerable...5.1 Medium
- olajowon loggroveLoggrove v1.0 is vulnerable to SQL Injection in the read.py file.5.1 Medium
- wuzhicmswuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app...5.4 Medium
- gpacBuffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code.8.4 High
- totolink a3002r firmwareTOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability...8.0 High
- totolink a3002r firmwareTOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability...8.0 High
- totolink a3002r firmwareTOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability...8.0 High
- syspassThe account file upload functionality in Syspass 3.2.x fails to properly handle special...6.5 Medium
- syspassA stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with...5.4 Medium
- seeddmsA Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin...5.4 Medium
- trendnet tew-929dru firmwareTrendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the...4.8 Medium
- trendnet tew-929dru firmwareTrendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the...4.8 Medium
- trendnet tew-929dru firmwareTrendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the...4.8 Medium
- trendnet tew-929dru firmwareTRENDnet TEW-929DRU 1.0.0.10 was discovered to contain a hardcoded password vulnerability in /etc...8.0 High
- 07fly 07flycmsCross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute...9.6 Critical
- No product listedCryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows...6.8 Medium
- shinetheme travel booking wordpress themeTraveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- thememakers car dealer automotive wordpress theme – responsiveCardealer <= 1.6.4 - Cross-Site Request Forgery to User Update via update_user_profile8.8 High
- thememakers car dealer automotive wordpress theme – responsiveCardealer <= 1.6.4 - Arbitrary Theme Option Update to Authenticated (Subscriber+) Privilege Escalation8.8 High
- thememakers car dealer automotive wordpress theme – responsiveCardealer <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Change and Delete JS and CSS Files5.4 Medium
- acronis backup extension for plesk, backup plugin for cpanel & whm +1 moreArbitrary file overwrite during home directory recovery due to improper symbolic link handling....4.4 Medium
- linux, linux kernel +1 moregpu: host1x: Fix a use of uninitialized mutex5.5 Medium
- linux, linux kernel +1 morebatman-adv: Drop unmanaged ELP metric worker7.8 High
- linux, linux kernel +1 moreptp: vmclock: Set driver data before its usage5.5 Medium
- linux, linux kernel +1 morefbdev: omap: use threaded IRQ for LCD DMA5.5 Medium
- Show moreLoading…