CVEs published February 7, 2025
117 CVEs were published on February 7, 2025: 8 critical, 52 high.
- Published
- 117
- Critical
- 8
- High
- 52
- Medium
- 53
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- laurent22 joplin
- 3
- OpenHarmony
- 3
- Black and White BookPress – For Book Authors
- 2
- Flexera RISC Platform
- 2
- Impronta Janto
- 2
- Soflyy WP All Import Pro
- 2
- WP All Import WP All Export Pro
- 2
- Alex Polonski Smart Countdown FX
- 1
- Amitythemes.com Breaking News Ticker
- 1
- Andrew Norcross Google Earth Embed
- 1
Critical 8
- CVE-2025-1107Unverified password change vulnerability in JantoImpronta Janto
- CVE-2025-25101WordPress Munk Sites plugin <= 1.0.7 - CSRF to Arbitrary Plugin Installation vulnerabilityMetricThemes Munk Sites
- CVE-2025-25107WordPress OneStore Sites plugin <= 0.1.1 - CSRF to Arbitrary Plugin Installation vulnerabilitysainwp OneStore Sites
- CVE-2025-25106WordPress Starter Templates by FancyWP plugin <= 2.0.0 - CSRF to Arbitrary Plugin Installation vulnerabilityStarter Templates by FancyWP
- CVE-2025-1077Remote Code Execution vulnerability in IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather)IBL Software Engineering Visual Weather · IBL Software E… +2
- CVE-2025-1061Nextend Social Login Pro <= 3.1.16 - Authentication Bypass via Apple OAuth providernextendweb Nextend Social Login Pro
- CVE-2024-55215An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register.
- CVE-2024-57707An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components.
High 52
- CVE-2025-25187Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplinlaurent22 joplin
- CVE-2025-24028Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplinlaurent22 joplin
- CVE-2025-24366Insufficient sanitization of user provided rsync command in SFTPGodrakkan sftpgo · github.com/drakkan/sftpgo/v2 +1
- CVE-2022-26389Improper Access Control Vulnerability in ELI Electrocardiograph DevicesBaxter/ Hillrom ELI 380 Resting Electrocardiograph · We… +2
- CVE-2024-7419WP All Export Pro <= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export FieldsWP All Import WP All Export Pro
- CVE-2024-9664WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import FileSoflyy WP All Import Pro
- CVE-2025-1103D-Link DIR-823X HTTP POST Request set_wifi_blacklists null pointer dereferenceD-Link DIR-823X
- CVE-2024-10383Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab VSCode ForkGitLab VSCode Fork
- CVE-2025-1108Insufficient data authenticity vulnerability in JantoImpronta Janto
- CVE-2025-25167WordPress BookPress – For Book Authors Plugin <= 1.2.7 - Broken Access Control vulnerabilityBlack and White BookPress – For Book Authors
- CVE-2025-25168WordPress BookPress – For Book Authors Plugin <= 1.2.7 - CSRF to Stored XSS vulnerabilityBlack and White BookPress – For Book Authors
- CVE-2025-25166WordPress InLocation plugin <= 1.8 - Cross Site Scripting (XSS) vulnerabilitygabrieldarezzo InLocation
- CVE-2025-25163WordPress Plugin A/B Image Optimizer Plugin <= 3.3 - Arbitrary File Download vulnerabilityZach Swetz Plugin A/B Image Optimizer
- CVE-2025-25155WordPress Music Sheet Viewer plugin <= 4.1 - Arbitrary File Read vulnerabilityefreja Music Sheet Viewer
- CVE-2025-25154WordPress Custom Comment Notifications plugin <= 1.0.8 - CSRF to Stored XSS vulnerabilityscweber Custom Comment Notifications
- CVE-2025-25159WordPress WP doodlez plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerabilityrobert_kolatzek WP doodlez
- CVE-2025-25160WordPress Style Tweaker plugin <= 0.11 - CSRF to Stored XSS vulnerabilityMark Barnes Style Tweaker
- CVE-2025-25152WordPress Smart DoFollow plugin <= 1.0.2 - CSRF to Stored XSS vulnerabilityLukaszWiecek Smart DoFollow
- CVE-2025-25156WordPress Quote Comments plugin <= 3.0.0 - CSRF to Stored XSS vulnerabilityStanko Metodiev Quote Comments
- CVE-2025-25153WordPress Simple Auto Tag plugin <= 1.1 - CSRF to Stored XSS vulnerabilitydjjmz Simple Auto Tag
- CVE-2025-25151WordPress uListing Plugin <= 2.1.6 - SQL Injection vulnerabilityStylemix uListing
- CVE-2025-25144WordPress Theasys plugin <= 1.0.1 - CSRF to Stored XSS vulnerabilityTheasys
- CVE-2025-25149WordPress Login-box plugin <= 2.0.4 - CSRF to Stored XSS vulnerabilityDanillo Nunes Login-box
- CVE-2025-25141WordPress Fami Sales Popup plugin <= 2.0.0 - Local File Inclusion vulnerabilityzankover Fami Sales Popup
- CVE-2025-25147WordPress Auto SEO plugin <= 2.5.6 - CSRF to Stored XSS vulnerabilityPhillip.Gooch Auto SEO
- CVE-2025-25138WordPress On Page SEO + Social Live Chat (Formerly OPS) plugin <= 2.0.0 - CSRF to Stored XSS vulnerabilityRishi On Page SEO + Whatsapp Chat Button
- CVE-2025-25135WordPress Custom Links On Admin Dashboard Toolbar plugin <= 3.3 - CSRF to Stored XSS vulnerabilityVictor Barkalov Custom Links On Admin Dashboard Toolbar
- CVE-2025-25148WordPress Read More Copy Link plugin <= 1.0.2 - CSRF to Stored XSS vulnerabilityElbowRobo Read More Copy Link
- CVE-2025-25140WordPress Simple User Profile plugin <= 1.9 - CSRF to Stored XSS vulnerabilityScriptonite Simple User Profile
- CVE-2025-25139WordPress WP Custom Post RSS Feed plugin <= 1.0.0 - CSRF to Stored XSS vulnerabilityCynob IT Consultancy WP Custom Post RSS Feed
- CVE-2025-25126WordPress ZMSEO plugin <= 1.14.1 - CSRF to Stored XSS vulnerabilityZMSEO
- CVE-2025-25128WordPress Facilita Form Tracker plugin <= 1.0 - CSRF to Stored XSS vulnerabilityorlandolac Facilita Form Tracker
- CVE-2025-25123WordPress Easy Related Posts plugin <= 2.0.2 - CSRF to Stored XSS vulnerabilityxdark Easy Related Posts
- CVE-2025-25125WordPress Fyrebox Quizzes plugin <= 3.1 - CSRF to Stored XSS vulnerabilityCyrilG Fyrebox Quizzes
- CVE-2025-25116WordPress Link to URL / Post plugin <=1.3 - SQL Injection vulnerabilitysudipto Link to URL / Post
- CVE-2025-25088WordPress WP Keyword Monitor Plugin <=1.0.5 - CSRF to Stored XSS vulnerabilityblackus3r WP Keyword Monitor
- CVE-2025-25104WordPress URL-Preview-Box plugin <= 1.20 - CSRF to Stored XSS vulnerabilitymraliende URL-Preview-Box
- CVE-2025-25071WordPress Vignette Ads plugin <= 0.2 - CSRF to Stored XSS vulnerabilitytopplugins Vignette Ads
- CVE-2025-25075WordPress Show notice or message on admin area plugin <= 2.0 - CSRF to Stored XSS vulnerabilityVenugopal Show notice or message on admin area
- CVE-2025-25074WordPress WP Social Stream plugin <= 1.1 - CSRF to Stored XSS vulnerabilityNirmal Kumar Ram WP Social Stream
- CVE-2025-25072WordPress WP Admin Custom Page plugin <= 1.5.0 - CSRF to Stored XSS vulnerabilitythunderbax WP Admin Custom Page
- CVE-2025-0304Liteos_a has an use after free vulnerabilityOpenHarmony
- CVE-2025-0303Liteos_a has a buffer overflow vulnerabilityOpenHarmony
- CVE-2025-22880Heap-based Buffer Overflow in CNCSoft-G2Delta Electronics CNCSoft-G2
- CVE-2024-13352Legull <= 1.2.2 - Reflected XSSLegull
- CVE-2024-48091Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll.
- CVE-2024-52881An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582.
- CVE-2024-52883An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582.
- CVE-2024-52884An issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841.
- CVE-2024-55272An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function.
- CVE-2024-57357An issue in TPLINK TL-WPA 8630 TL-WPA8630(US)_V2_2.0.4 Build 20230427 allows a remote attacker to execute arbitrary code via function sub_42
- CVE-2024-57606SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker to obtain sensitive org.jeecgframework.boot:jeecg-boot-common
Medium, low and unrated 57
- CVE-2025-1114newbee-mall Add Category Page save cross site scriptingnewbee-mall
- CVE-2024-55630DOM Clobbering leads to temporary DOS in the note viewer in Joplinlaurent22 joplin
- CVE-2025-1113taisan tarzan-cms Add Theme admin#themes upload deserializationtaisan tarzan-cms
- CVE-2025-25183vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cachevllm-project vllm · vllm
- CVE-2025-24980Pimcore Admin Classic Bundle allows user enumerationpimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…
- CVE-2021-41528Improper authorization related to Import / Export interfaces on RISC PlatformFlexera RISC Platform
- CVE-2021-415272FA bypass on the RISC PlatformFlexera RISC Platform
- CVE-2021-27017Deserialization of untrusted dataPuppetPu Puppet Agent
- CVE-2025-1106CmsEasy database_admin.php restore_action path traversalCmsEasy
- CVE-2025-1105SiberianCMS HTTP GET Request flat cross site scriptingSiberianCMS
- CVE-2022-26388Use of Hard-Coded Password Vulnerability in ELI Electrocardiograph DevicesWelch Allyn ELI 380 Resting Electrocardiograph · Welch A… +2
- CVE-2025-1104D-Link DHP-W310AV authentication spoofingD-Link DHP-W310AV
- CVE-2024-7425WP All Export Pro <= 1.9.1 - Authenticated (ShopManager+) Arbtirary Options UpdateWP All Import WP All Export Pro
- CVE-2024-9661WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content DeletionSoflyy WP All Import Pro
- CVE-2025-25069Apache Kvrocks: Cross-Protocol Scripting VulnerabilityApache Software Foundation Apache Kvrocks
- CVE-2025-25143WordPress GlobalQuran Plugin <= 1.0 - CSRF to Settings Change vulnerabilityibasit GlobalQuran
- CVE-2025-25145WordPress Infusionsoft Analytics Plugin <= 2.0 - Cross-Site Request Forgery (CSRF) vulnerabilityjordan.hatch Infusionsoft Analytics
- CVE-2025-25136WordPress Optimate Ads plugin <= 1.0.3 - Cross-Site Scripting (XSS) vulnerabilityshujahat21 Optimate Ads
- CVE-2025-25146WordPress Songkick Concerts and Festivals plugin <= 0.9.7 - Cross Site Request Forgery (CSRF) vulnerabilitysaleandro Songkick Concerts and Festivals
- CVE-2025-25117WordPress Smart Countdown FX plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerabilityAlex Polonski Smart Countdown FX
- CVE-2025-25120WordPress Slide Banners plugin <= 1.3 - Broken Access Control vulnerabilityMelodic Media Slide Banners
- CVE-2025-25103WordPress Indeed API Plugin <= 0.5 - CSRF to Settings Change vulnerabilitybnielsen Indeed API
- CVE-2025-25105WordPress Pop Up Plugin <= 0.1 - Cross Site Scripting (XSS) vulnerabilitycoffeestudios Pop Up
- CVE-2025-25097WordPress External "Video for Everybody" plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilitykwiliarty External Video For Everybody
- CVE-2025-25110WordPress Event Kikfyre plugin <= 2.1.8 - Broken Access Control vulnerabilityMetagauss Event Kikfyre
- CVE-2025-25111WordPress WP Spell Check plugin <= 9.21 - Cross Site Request Forgery (CSRF) vulnerabilityWP Spell Check
- CVE-2025-25081WordPress Embed RSS plugin <= 3.1 - Arbitrary Shortcode Execution vulnerabilityDeannaS Embed RSS
- CVE-2025-25093WordPress Child Themes Helper plugin <= 2.2.7 - CSRF to Arbitrary File Deletion vulnerabilitypaulswarthout Child Themes Helper
- CVE-2025-25095WordPress ReverbNation Widgets plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability<reverbnationdev ReverbNation Widgets
- CVE-2025-25096WordPress RSS in Page plugin <= 2.9.1 - Stored Cross Site Scripting (XSS) vulnerabilitytitusbicknell RSS in Page
- CVE-2025-25085WordPress WP SimpleWeather plugin <= 0.2.5 - Cross Site Scripting (XSS) vulnerabilitymatt_mcbrien WP SimpleWeather
- CVE-2025-25094WordPress Breaking News Ticker plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerabilityAmitythemes.com Breaking News Ticker
- CVE-2025-25080WordPress Kona Gallery Block plugin <= 1.7 - Stored Cross Site Scripting (XSS) vulnerabilitygubbigubbi Kona Gallery Block
- CVE-2025-25077WordPress Easy Chart Builder for WordPress plugin <= 1.3 - Stored Cross Site Scripting (XSS) vulnerabilitydugbug Easy Chart Builder for WordPress
- CVE-2025-25078WordPress Google Earth Embed plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityAndrew Norcross Google Earth Embed
- CVE-2025-25079WordPress Simple Select All Text Box plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityGarrett Grimm Simple Select All Text Box
- CVE-2025-25098WordPress Links in Captions plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerabilityZack Katz Links in Captions
- CVE-2025-25073WordPress Easy WP Tiles plugin <= 1 - Cross Site Scripting (XSS) vulnerabilityVasilis Triantafyllou Easy WP Tiles
- CVE-2025-25082WordPress flexIDX Home Search plugin <= 2.1.2 - Stored Cross Site Scripting (XSS) vulnerabilityMax Chirkov FlexIDX Home Search
- CVE-2025-25091WordPress NextGen Cooliris Gallery plugin <= 0.7 - Cross Site Scripting (XSS) vulnerabilityzackdesign NextGen Cooliris Gallery
- CVE-2025-25076WordPress Graceful Email Obfuscation plugin <= 0.2.2 - Cross Site Scripting (XSS) vulnerabilitynicholaswilson Graceful Email Obfuscation
- CVE-2025-0302Liteos_a has an integer overflow read vulnerabilityOpenHarmony
- CVE-2025-23085A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification.NodeJS Node
- CVE-2024-13841Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time <= 1.0.0 - Authenticated (Contributor+) Post Disclosuredaveshine Builder Shortcode Extras – WordPress Shortcodes C…
- CVE-2024-13492Guten Free Options <= 0.9.5 - Reflected XSSGuten Free Options
- CVE-2025-1072Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-22402Dell Update Manager Plugin, version(s) 1.5.0 through 1.6.0, contain(s) an Improper Neutralization of Script-Related HTML Tags in a Web Page Dell Update Manager Plugin
- CVE-2025-1086Safetytest Cloud-Master Server static path traversalSafetytest Cloud-Master Server
- CVE-2025-1085Animati PACS login cross site scriptingAnimati PACS
- CVE-2024-35106NEXTU FLETA AX1500 WIFI6 v1.0.3 was discovered to contain a buffer overflow at /boafrm/formIpQoS.
- CVE-2024-52882An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582.
- CVE-2024-55213Directory Traversal vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the File Listin
- CVE-2024-55214Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file downl
- CVE-2024-57248Directory Traversal in File Upload in Gleamtech FileVista 9.2.0.0 allows remote attackers to achieve Code Execution, Information Disclosure,
- CVE-2024-57249Incorrect Access Control in the Preview Function of Gleamtech FileVista 9.2.0.0 allows remote attackers to gain unauthorized access via expl
- CVE-2024-57278A reflected Cross-Site Scripting (XSS) vulnerability exists in /webscan/sqlmap/index.html in QingScan <=v1.8.0.
- CVE-2024-57279A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the LDAP User Manager <= ce92321, specifically in the /setup/ind