# CVEs published 2022-02-28

81 CVEs were published on February 28, 2022: 1 critical, 2 high. Days are UTC.

- [CVE-2022-0743](https://cve.now/CVE-2022-0743.md): Cross-site Scripting (XSS) - Stored in getgrav/grav (CVSS 4.6, getgrav/grav)
- [CVE-2022-25413](https://cve.now/CVE-2022-25413.md): Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f\_tags at /admin/page\_edit/3. (no CVSS)
- [CVE-2022-25412](https://cve.now/CVE-2022-25412.md): Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin\_page/all-files-update-ajax.php via the (no CVSS)
- [CVE-2022-25411](https://cve.now/CVE-2022-25411.md): A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted P (no CVSS)
- [CVE-2022-25409](https://cve.now/CVE-2022-25409.md): Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the demail parameter at /adm (no CVSS)
- [CVE-2022-25410](https://cve.now/CVE-2022-25410.md): Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f\_file\_description at /admin/ (no CVSS)
- [CVE-2022-25407](https://cve.now/CVE-2022-25407.md): Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Doctor parameter at /adm (no CVSS)
- [CVE-2022-25408](https://cve.now/CVE-2022-25408.md): Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the dpassword parameter at / (no CVSS)
- [CVE-2022-25028](https://cve.now/CVE-2022-25028.md): Home Owners Collection Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the collected\_by para (no CVSS)
- [CVE-2022-23907](https://cve.now/CVE-2022-23907.md): CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1\_fmmessage. (no CVSS)
- [CVE-2022-23906](https://cve.now/CVE-2022-23906.md): CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. (no CVSS)
- [CVE-2021-45414](https://cve.now/CVE-2021-45414.md): A Remote Code Execution (RCE) vulnerability exists in DataRobot through 2021-10-28 because it allows submission of a Docker environment or J (no CVSS)
- [CVE-2021-41112](https://cve.now/CVE-2021-41112.md): Missing Authorization in Rundeck (CVSS 8.1, rundeck)
- [CVE-2021-41111](https://cve.now/CVE-2021-41111.md): Authorization Bypass Through User-Controlled Key in Rundeck (CVSS 6.4, rundeck)
- [CVE-2022-25015](https://cve.now/CVE-2022-25015.md): A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into (no CVSS)
- [CVE-2022-25014](https://cve.now/CVE-2022-25014.md): Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of t (no CVSS)
- [CVE-2022-25013](https://cve.now/CVE-2022-25013.md): Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters (no CVSS)
- [CVE-2020-22845](https://cve.now/CVE-2020-22845.md): A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests. (no CVSS)
- [CVE-2020-22844](https://cve.now/CVE-2020-22844.md): A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests. (no CVSS)
- [CVE-2022-26181](https://cve.now/CVE-2022-26181.md): Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned\_dealloc():src/lepton/bitops.cc:1 (no CVSS)
- [CVE-2022-25023](https://cve.now/CVE-2022-25023.md): Audio File commit 004065d was discovered to contain a heap-buffer overflow in the function fouBytesToInt():AudioFile.h. (no CVSS)
- [CVE-2022-26315](https://cve.now/CVE-2022-26315.md): qrcp through 0.8.4, in receive mode, allows ../ Directory Traversal via the file name specified by the uploader. (no CVSS)
- [CVE-2021-44331](https://cve.now/CVE-2021-44331.md): ARM astcenc 3.2.0 is vulnerable to Buffer Overflow in function encode\_ise(). (no CVSS)
- [CVE-2021-44342](https://cve.now/CVE-2021-44342.md): David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow via function ok\_png\_transform\_scanline() in "/ok\_png.c:494". (no CVSS)
- [CVE-2022-24712](https://cve.now/CVE-2022-24712.md): Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4 (CVSS 6.3, CodeIgniter4 · codeigniter4/framework)
- [CVE-2021-44340](https://cve.now/CVE-2021-44340.md): David Brackeen ok-file-formats dev version is vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2022-24711](https://cve.now/CVE-2022-24711.md): Remote CLI Command Execution Vulnerability in CodeIgniter4 (CVSS 9.4, CodeIgniter4 · codeigniter4/framework)
- [CVE-2022-26158](https://cve.now/CVE-2022-26158.md): An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. (no CVSS)
- [CVE-2022-26157](https://cve.now/CVE-2022-26157.md): An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. (no CVSS)
- [CVE-2021-44339](https://cve.now/CVE-2021-44339.md): David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2022-26156](https://cve.now/CVE-2022-26156.md): An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. (no CVSS)
- [CVE-2022-26155](https://cve.now/CVE-2022-26155.md): An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. (no CVSS)
- [CVE-2022-25642](https://cve.now/CVE-2022-25642.md): Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS. (no CVSS)
- [CVE-2021-44334](https://cve.now/CVE-2021-44334.md): David Brackeen ok-file-formats 97f78ca is vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2021-43086](https://cve.now/CVE-2021-43086.md): ARM astcenc 3.2.0 is vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2022-24685](https://cve.now/CVE-2022-24685.md): HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU (no CVSS, github.com/hashicorp/nomad)
- [CVE-2022-24572](https://cve.now/CVE-2022-24572.md): Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field). (no CVSS)
- [CVE-2022-24571](https://cve.now/CVE-2022-24571.md): Car Driving School Management System v1.0 is affected by SQL injection in the login page. (no CVSS)
- [CVE-2022-0768](https://cve.now/CVE-2022-0768.md): Server-Side Request Forgery (SSRF) in rudloff/alltube (CVSS 8.6, rudloff/alltube)
- [CVE-2022-23988](https://cve.now/CVE-2022-23988.md): WS Form \< 1.8.176 - Unauthenticated Stored Cross-Site Scripting (no CVSS, WS Form LITE – Drag & Drop Contact Form Builder for WordPre…)
- [CVE-2022-23987](https://cve.now/CVE-2022-23987.md): WS Form \< 1.8.176 - Admin+ Stored Cross-Site Scripting (no CVSS, WS Form LITE – Drag & Drop Contact Form Builder for WordPre…)
- [CVE-2022-23912](https://cve.now/CVE-2022-23912.md): AP Custom Testimonial \< 1.4.8 - Reflected Cross-Site Scripting (no CVSS, Testimonial WordPress Plugin – AP Custom Testimonial)
- [CVE-2022-23911](https://cve.now/CVE-2022-23911.md): AP Custom Testimonial \< 1.4.8 - Admin+ SQL Injection (no CVSS, Testimonial WordPress Plugin – AP Custom Testimonial)
- [CVE-2022-0412](https://cve.now/CVE-2022-0412.md): TI WooCommerce Wishlist \< 1.40.1 - Unauthenticated Blind SQL Injection (no CVSS, TemplateInvaders TI WooCommerce Wishlist)
- [CVE-2022-0411](https://cve.now/CVE-2022-0411.md): Asgaros Forum \< 2.0.0 - Subscriber+ Blind SQL Injection (no CVSS, Asgaros Forum)
- [CVE-2022-0385](https://cve.now/CVE-2022-0385.md): Crazy Bone \<= 0.6.0 - Unauthenticated Stored XSS (no CVSS, Crazy Bone)
- [CVE-2022-0383](https://cve.now/CVE-2022-0383.md): WP Review Slider \< 11.0 - Admin+ SQL Injection (no CVSS, WP Review Slider)
- [CVE-2022-0377](https://cve.now/CVE-2022-0377.md): LearnPress \< 4.1.5 - Arbitrary Image Renaming (no CVSS, LearnPress)
- [CVE-2022-0360](https://cve.now/CVE-2022-0360.md): WP Ultimate CSV Importer \< 6.4.3 - Admin+ Stored Cross-Site Scripting (no CVSS, Easy Drag And drop All Import : WP Ultimate CSV Importer)
- [CVE-2022-0345](https://cve.now/CVE-2022-0345.md): Better Notifications for WP \< 1.8.7 - Email Address Disclosure (no CVSS, Customize WordPress Emails and Alerts)
- [CVE-2022-0328](https://cve.now/CVE-2022-0328.md): Simple Membership \< 4.0.9 - Arbitrary Member Deletion via CSRF (no CVSS, Simple Membership)
- [CVE-2022-0189](https://cve.now/CVE-2022-0189.md): WP RSS Aggregator \< 4.20 - Reflected Cross-Site Scripting (XSS) (no CVSS, WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video…)
- [CVE-2022-0150](https://cve.now/CVE-2022-0150.md): WP Accessibility Helper (WAH) \< 0.6.0.7 - Reflected Cross-Site Scripting (XSS) (no CVSS, WP Accessibility Helper)
- [CVE-2021-4222](https://cve.now/CVE-2021-4222.md): WP Paginate \< 2.1.4 - Admin+ Stored Cross-Site Scripting (no CVSS, WP-Paginate)
- [CVE-2021-25118](https://cve.now/CVE-2021-25118.md): Yoast SEO 16.7-17.2 - Unauthenticated Full Path Disclosure (no CVSS, Yoast SEO)
- [CVE-2021-25112](https://cve.now/CVE-2021-25112.md): WHMCS Bridge \< 6.4b - Reflected Cross-Site Scripting (XSS) (no CVSS, WHMCS Bridge)
- [CVE-2021-25081](https://cve.now/CVE-2021-25081.md): WP Google Map \< 1.8.4 - Arbitrary Post Deletion and Plugin's Settings Update via CSRF (no CVSS, Maps Plugin using Google Maps for WordPress – WP Google Map)
- [CVE-2021-25042](https://cve.now/CVE-2021-25042.md): WP Visitor Statistics (Real Time Traffic) \< 5.5 - Arbitrary IP Address Exclusion to Stored XSS (no CVSS, WP Visitor Statistics)
- [CVE-2021-25034](https://cve.now/CVE-2021-25034.md): WP User \< 7.0 - Reflected Cross-Site Scripting (no CVSS, WP User – Custom Registration Forms, Login and User Profile)
- [CVE-2021-25011](https://cve.now/CVE-2021-25011.md): WP Google Map \< 1.8.1 - Subscriber+ Arbitrary Post Deletion and Plugin's Settings Update (no CVSS, Maps Plugin using Google Maps for WordPress – WP Google Map)
- [CVE-2021-25010](https://cve.now/CVE-2021-25010.md): Post Snippets \< 3.1.4 - CSRF to Stored Cross-Site Scripting (no CVSS, Post Snippets)
- [CVE-2021-24994](https://cve.now/CVE-2021-24994.md): WPvivid Backup and Migration Plugin \< 0.9.69 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Migration, Backup, Staging – WPvivid Backup and Migration P…)
- [CVE-2021-24977](https://cve.now/CVE-2021-24977.md): Use Any Font \< 6.2.1 - Unauthenticated Arbitrary CSS Appending (no CVSS, Use Any Font | Custom Font Uploader)
- [CVE-2021-24971](https://cve.now/CVE-2021-24971.md): WP Responsive Menu \< 3.1.7.1 - Subscriber+ Settings Update to Stored XSS (no CVSS, WP Responsive Menu)
- [CVE-2021-24933](https://cve.now/CVE-2021-24933.md): Dynamic Widgets \<= 1.5.16 - Reflected Cross-Site Scripting (no CVSS, Dynamic Widgets)
- [CVE-2021-24920](https://cve.now/CVE-2021-24920.md): StatCounter \< 2.0.7 - Admin+ Stored Cross-Site Scripting (no CVSS, StatCounter – Free Real Time Visitor Stats)
- [CVE-2021-24913](https://cve.now/CVE-2021-24913.md): Logo Showcase with Slick Slider \< 2.0.1 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF (no CVSS, Logo Showcase with Slick Slider – Logo Carousel, Logo Slide…)
- [CVE-2021-24903](https://cve.now/CVE-2021-24903.md): GRAND FlaGallery \<= 6.1.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Album and Image Gallery with Lightbox – Flagallery Photo Po…)
- [CVE-2021-24901](https://cve.now/CVE-2021-24901.md): Security Audit \<= 1.0.0 - Admin+ Stored Cross Site Scripting (no CVSS, Security Audit)
- [CVE-2021-24898](https://cve.now/CVE-2021-24898.md): EditableTable \<= 0.1.4 - Admin+ Stored Cross-Site Scripting (no CVSS, Editable Table Simple Fast FrontEnd From Sql tables)
- [CVE-2021-24864](https://cve.now/CVE-2021-24864.md): WP Cloudy \< 4.4.9 - Admin+ SQL Injection (no CVSS, WP Cloudy, weather plugin)
- [CVE-2021-24823](https://cve.now/CVE-2021-24823.md): Support Board \< 3.3.6 - Arbitrary File Deletion via CSRF (no CVSS, Support Board)
- [CVE-2021-24820](https://cve.now/CVE-2021-24820.md): Cost Calculator \<= 1.6 - Authenticated Local File Inclusion (no CVSS, Cost Calculator)
- [CVE-2021-24803](https://cve.now/CVE-2021-24803.md): Core Tweaks WP Setup \<= 4.1 - Arbitrary Admin Account Creation / Admin Email Update via CSRF (no CVSS, Core Tweaks WP Setup)
- [CVE-2021-24730](https://cve.now/CVE-2021-24730.md): Logo Showcase with Slick Slider \< 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update (no CVSS, Logo Showcase with Slick Slider – Logo Carousel, Logo Slide…)
- [CVE-2021-24704](https://cve.now/CVE-2021-24704.md): Orange Form \<= 1.0 - SQL Injection via CSRF (no CVSS, Orange Form)
- [CVE-2021-24689](https://cve.now/CVE-2021-24689.md): Contact Forms - Drag & Drop Contact Form Builder \<= 1.0.5 - Admin+ Arbitrary System File Read (no CVSS, Contact Forms – Drag & Drop Contact Form Builder)
- [CVE-2021-24688](https://cve.now/CVE-2021-24688.md): Orange Form \<= 1.0.1 - Unauthenticated Arbitrary Post Deletion (no CVSS, Orange Form)
- [CVE-2020-36510](https://cve.now/CVE-2020-36510.md): 15Zine \< 3.3.0 - Reflected Cross-Site Scripting (no CVSS, 15Zine)
- [CVE-2022-26159](https://cve.now/CVE-2022-26159.md): The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service (no CVSS)
- [CVE-2021-43945](https://cve.now/CVE-2021-43945.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrar (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.