# CVEs published 2025-02-08

7 CVEs were published on February 8, 2025: 1 critical, 0 high. Days are UTC.

- [CVE-2025-0169](https://cve.now/CVE-2025-0169.md): DWT - Directory & Listing WordPress Theme \<=3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, scriptsbundle DWT - Directory & Listing WordPress Theme)
- [CVE-2025-0316](https://cve.now/CVE-2025-0316.md): WP Directorybox Manager \<= 2.5 - Authentication Bypass (CVSS 9.8, Chimpstudio WP Directorybox Manager)
- [CVE-2024-54176](https://cve.now/CVE-2024-54176.md): IBM UrbanCode Deploy missing authentication (CVSS 4.3, IBM UrbanCode Deploy · IBM DevOps Deploy)
- [CVE-2025-1117](https://cve.now/CVE-2025-1117.md): CoinRemitter sql injection (CVSS 6.9, CoinRemitter)
- [CVE-2024-13850](https://cve.now/CVE-2024-13850.md): Simple add pages or posts \<= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, ramon-fincken Simple add pages or posts)
- [CVE-2025-1116](https://cve.now/CVE-2025-1116.md): Dreamvention Live AJAX Search Free live\_search.searchresults search sql injection (CVSS 6.9, Dreamvention Live AJAX Search Free)
- [CVE-2025-1115](https://cve.now/CVE-2025-1115.md): RT-Thread lwp\_syscall.c sys\_timer\_settime information disclosure (CVSS 4.8, RT-Thread)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.