CVEs published February 14, 2025
132 CVEs were published on February 14, 2025: 8 critical, 72 high.
- Published
- 132
- Critical
- 8
- High
- 72
- Medium
- 49
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- Brocade SANnav
- 5
- Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJe…
- 3
- Rupeeseed Technology Ventures RupeeWeb
- 3
- WatchGuard Fireware OS
- 3
- bitpressadmin Chat Widget: Floating Customer Support Button…
- 2
- brandtoss WP Mailster
- 2
- HumanSignal label-studio · label-studio
- 2
- SICK AG SICK Lector8xx · SICK AG SICK InspectorP8xx
- 2
- wpswings Return Refund and Exchange For WooCommerce
- 2
- Ability Accessibility Suite
- 1
Critical 8
- CVE-2025-26506Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers – Potential Remote Code Execution and Potential Elevation of PrivilegeCertain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJe…
- CVE-2024-56180Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code executionApache Software Foundation Apache EventMesh · org.apache.ev…
- CVE-2024-13152SQLi in BSS Software's Mobuy Online Machinery Monitoring PanelBSS Software Mobuy Online Machinery Monitoring Panel
- CVE-2025-0867Privilege Escalation in MEAC300SICK AG SICK MEAC300
- CVE-2024-52577Apache Ignite: Possible RCE when deserializing incoming messages by the server nodeApache Software Foundation Apache Ignite · org.apache.ignit…
- CVE-2025-1298Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover.TECNO com.transsion.carlcare
- CVE-2025-22630WordPress Widget Options Plugin <= 4.1.0 - Arbitrary Code Execution vulnerabilityMarketing Fire Widget Options
- CVE-2024-56973Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary
High 72
- CVE-2024-4282Weak TLS Ciphers on Brocade SANnav OVA SSH port 22Brocade SANnav
- CVE-2022-26083Generation of weak initialization vector in an Intel(R) IPP Cryptography software library before version 2021.5 may allow an unauthenticatedIntel(R) IPP Cryptography software library
- CVE-2025-0593SICK Lector8xx and InspectorP8xx vulnerable for code executionSICK AG SICK Lector8xx · SICK AG SICK InspectorP8xx
- CVE-2025-0592SICK Lector8xx and InspectorP8xx vulnerable for code executionSICK AG SICK Lector8xx · SICK AG SICK InspectorP8xx
- CVE-2025-25297Label Studio allows Server-Side Request Forgery in the S3 Storage EndpointHumanSignal label-studio · label-studio
- CVE-2025-26508Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers – Potential Remote Code Execution and Potential Elevation of PrivilegeCertain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJe…
- CVE-2025-25295Label Studio has a Path Traversal Vulnerability via image FieldHumanSignal label-studio · label-studio-sdk
- CVE-2025-25206Incorrect input validation could allow an authenticated user to read sensitive informationelabftw
- CVE-2024-8893Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd.GoodWe Technologies Co. GW1500‑XS
- CVE-2024-12651Sensitive Data Exposure in PTT Inc.'s HGS Mobile AppPTT HGS Mobile App
- CVE-2025-23905WordPress Admin Options Pages plugin <= 0.9.7 - Reflected Cross Site Scripting (XSS) vulnerabilityJohannes van Poelgeest Admin Options Pages
- CVE-2025-22705WordPress Disqus Popular Posts plugin <= 2.1.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerabilitygodthor Disqus Popular Posts
- CVE-2024-52500WordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerabilitymonetagwp Monetag Official Plugin
- CVE-2025-24692WordPress Bulk Menu Edit plugin <= 1.3 - Broken Access Control vulnerabilityM.Code Bulk Menu Edit
- CVE-2025-24688WordPress WP Mailster Plugin <= 1.8.20.0 - Reflected Cross Site Scripting (XSS) vulnerabilitybrandtoss WP Mailster
- CVE-2025-24700WordPress WP Event Aggregator Plugin <= 1.8.2 - Reflected Cross Site Scripting (XSS) vulnerabilityXylus Themes WP Event Aggregator
- CVE-2025-24699WordPress WP Coder Plugin <= 3.6 - CSRF to Cross Site Scripting (XSS) vulnerabilityWow-Company WP Coder
- CVE-2025-24641WordPress Better WishList API plugin <= 1.1.3 - Stored Cross Site Scripting (XSS) vulnerabilityrickonline_nl Better WishList API
- CVE-2025-24617WordPress AcyMailing Plugin < 9.11.1 - Reflected Cross Site Scripting (XSS) vulnerabilityAcyMailing Newsletter Team AcyMailing SMTP Newsletter
- CVE-2025-24616WordPress Uix Page Builder Plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityUIUX Lab Uix Page Builder
- CVE-2025-24615WordPress Analytics Cat Plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityfatcatapps Analytics Cat
- CVE-2025-24614WordPress Post Timeline Plugin <= 2.3.9 - Reflected Cross Site Scripting (XSS) vulnerabilityAgile Logix Post Timeline
- CVE-2025-24592WordPress SysBasics Customize My Account for WooCommerce plugin <= 2.8.22 - Reflected Cross Site Scripting (XSS) vulnerabilitySysBasics Customize My Account for WooCommerce
- CVE-2025-24566WordPress Intro Tour Tutorial DeepPresentation plugin <= 6.5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityTomáš Groulík Intro Tour Tutorial DeepPresentation
- CVE-2025-24565WordPress WP2LEADS plugin <= 3.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilitySaleswonder Team: Tobias WP2LEADS
- CVE-2025-24564WordPress Contact Form With Shortcode plugin <= 4.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityaviplugins.com Contact Form With Shortcode
- CVE-2025-24558WordPress CRM Perks plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityCRM Perks
- CVE-2025-24554WordPress AWcode Toolkit plugin <= 1.0.14 - Reflected Cross Site Scripting (XSS) vulnerabilityAWcode Toolkit
- CVE-2025-23857WordPress Essential WP Real Estate Plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilitySmartDataSoft Essential WP Real Estate
- CVE-2025-23853WordPress NoFollow Free plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerabilitymichelem NoFollow Free
- CVE-2025-23851WordPress Coronavirus (COVID-19) Outbreak Data Widgets Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityKhushwant Singh Coronavirus (COVID-19) Outbreak Data Widgets
- CVE-2025-23790WordPress Easy Code Placement Plugin <= 18.11 - Reflected Cross Site Scripting (XSS) vulnerabilitywassereimer Easy Code Placement
- CVE-2025-23789WordPress URL Shortener WooCommerce Plugin <= 9.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilitytahminajannat URL Shortener | Conversion Tracking | AB Tes…
- CVE-2025-23788WordPress Easy Filter Plugin <= 1.10 - Reflected Cross Site Scripting (XSS) vulnerabilityRoni Saha Easy Filter
- CVE-2025-23787WordPress Easy Bet Plugin <= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityFoxskav Easy Bet
- CVE-2025-23786WordPress Email to Download Plugin <= 3.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityDuoGeek Email to Download
- CVE-2025-23751WordPress Data Dash plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityThink201 Data Dash
- CVE-2025-23750WordPress Custom Widget Creator plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilitydevbunchuk Custom Widget Creator
- CVE-2025-23748WordPress Singsys -Awesome Gallery plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySingsys -Awesome Gallery
- CVE-2025-23742WordPress Podamibe Twilio Private Call plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityPodamibe Nepal Podamibe Twilio Private Call
- CVE-2025-23658WordPress Advanced Angular Contact Form plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityTauhidul Alam Advanced Angular Contact Form
- CVE-2025-23657WordPress WordPress-to-candidate for Salesforce CRM plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityRusAlex WordPress-to-candidate for Salesforce CRM
- CVE-2025-23655WordPress Contact Form 7 – Paystack Add-on plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilitycrystalwebpro Contact Form 7 – Paystack Add-on
- CVE-2025-23653WordPress Form To Online Booking plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityNabeel Tahir Form To Online Booking
- CVE-2025-23652WordPress Add custom content after post plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityFabio Zuanon Add custom content after post
- CVE-2025-23651WordPress Scroll Top plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityadamskaat Scroll Top
- CVE-2025-23650WordPress Tidy.ro plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityrazvypp Tidy.ro
- CVE-2025-23648WordPress AdsMiddle plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitywjharil AdsMiddle
- CVE-2025-23647WordPress WP-Clap plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityAriagle WP-Clap
- CVE-2025-23646WordPress Library Instruction Recorder plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityMatt Brooks Library Instruction Recorder
- CVE-2025-23598WordPress Recip.ly plugin <= 1.1.8 - Reflected Cross Site Scripting (XSS) vulnerabilitycraig.edmunds@gmail.com Recip.ly
- CVE-2025-23571WordPress Internal Links Generator plugin <= 3.51 - Reflected Cross Site Scripting (XSS) vulnerabilitymakong Internal Links Generator
- CVE-2025-23568WordPress WP Login Attempt Log plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityfredsted WP Login Attempt Log
- CVE-2025-23525WordPress Kv Compose Email From Dashboard plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitykvvaradha Kv Compose Email From Dashboard
- CVE-2025-23523WordPress HSS Embed Streaming Video plugin <= 3.23 - Reflected Cross Site Scripting (XSS) vulnerabilityhoststreamsell HSS Embed Streaming Video
- CVE-2025-23492WordPress 淘宝客插件 plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityCantonBolo WordPress 淘宝客插件
- CVE-2025-23474WordPress Live Dashboard plugin <= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMike Martel Live Dashboard
- CVE-2025-23431WordPress Envato Affiliater plugin <= 1.2.4 - Reflected Cross Site Scripting (XSS) vulnerabilitykhaninejad Envato Affiliater
- CVE-2025-23428WordPress QMean plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityArash Safari QMean – WordPress Did You Mean
- CVE-2025-26523Insufficient Authorization Vulnerability in RupeeWeb trading platformRupeeseed Technology Ventures RupeeWeb
- CVE-2025-26522Authentication Bypass Vulnerability in RupeeWeb trading platformRupeeseed Technology Ventures RupeeWeb
- CVE-2024-2240Docker implementation in Brocade SANnav is missing Audit Rules.Brocade SANnav
- CVE-2025-1053Brocade SANnav encryption key is logged in the debug logsBrocade SANnav
- CVE-2024-55904IBM DevOps Deploy / IBM UrbanCode Deploy command injectionIBM UrbanCode Deploy · IBM DevOps Deploy
- CVE-2024-57778An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from st
- CVE-2025-25745D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetQuick
- CVE-2025-25994SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2,
- CVE-2025-25997Directory Traversal vulnerability in FeMiner wms v.1.0 allows a remote attacker to obtain sensitive information via the databak.php componen
- CVE-2025-26156A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attacke
- CVE-2025-26519musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusmusl-libc musl
- CVE-2025-26788StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.StrongKey FIDO Server
- CVE-2025-26819Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections.getmonero Monero
Medium, low and unrated 52
- CVE-2024-5462Brocade Fabric OS may capture SNMP Passwords in clear textBrocade Fabric OS
- CVE-2024-10405Weak TLS Ciphers on Brocade SANnav port 443 & 18082Brocade SANnav
- CVE-2025-21401Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2022-28693Unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized user to potentially eIntel(R) Processors
- CVE-2024-31144Xapi: Metadata injection attack against backup/restore functionalityXen Project Xen
- CVE-2025-25290@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtrackingoctokit request.js · @octokit/request
- CVE-2025-25289@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtrackingoctokit request-error.js · @octokit/request-error
- CVE-2025-25288@octokit/plugin-paginate-rest has a Regular Expression in iterator that Leads to ReDoS Vulnerability Due to Catastrophic Backtrackingoctokit plugin-paginate-rest.js · @octokit/plugin-paginate-…
- CVE-2025-25285@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtrackingoctokit endpoint.js · @octokit/endpoint
- CVE-2025-25304Vega allows Cross-site Scripting via the vlSelectionTuples functionvega · vega-selections
- CVE-2025-25296Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpointHumanSignal label-studio · label-studio
- CVE-2025-0503Leaked User IDs and Metadata of Deleted DMsMattermost
- CVE-2025-26507Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers – Potential Remote Code Execution and Potential Elevation of PrivilegeCertain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJe…
- CVE-2025-25204`gh attestation verify` returns incorrect exit code during verification if no attestations are presentcli · github.com/cli/cli +1
- CVE-2024-3220Default mimetype known files writeable on WindowsPython Software Foundation CPython · python +1
- CVE-2024-56463IBM QRadar SIEM cross-site scriptingIBM QRadar SIEM
- CVE-2024-56477IBM Power Hardware Management Console directory traversalIBM Power Hardware Management Console
- CVE-2024-52895IBM i denial of serviceIBM i
- CVE-2025-0178WatchGaurd Firebox Host Header Injection VulnerabilityWatchGuard Fireware OS
- CVE-2025-1239WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Blocked Sites ListWatchGuard Fireware OS
- CVE-2025-1071WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker ModuleWatchGuard Fireware OS
- CVE-2025-22702WordPress Photography Theme <= 7.7.2 - Broken Access Control VulnerabilityThemeGoods Photography
- CVE-2025-22698WordPress Accessibility Suite by Ability, Inc plugin <= 4.18 - Multiple Broken Access Control vulnerabilityAbility Accessibility Suite
- CVE-2025-24607WordPress IdeaPush plugin <= 8.71 - Broken Access Control vulnerabilityNorthern Beaches Websites IdeaPush
- CVE-2025-24567WordPress WP Mailster plugin <= 1.8.16.0 - Sensitive Data Exposure vulnerabilitybrandtoss WP Mailster
- CVE-2025-23771WordPress Push Notification for Post and BuddyPress plugin <= 2.11 - Settings Change vulnerabilityMurali Push Notification for Post and BuddyPress
- CVE-2025-23766WordPress OPSI Israel Domestic Shipments plugin <= 2.8.2 - Broken Access Control vulnerabilityashamil OPSI Israel Domestic Shipments
- CVE-2025-23534WordPress WPLingo plugin <= 1.1.2 - Arbitrary Content Deletion vulnerabilityMark Winiarski WPLingo
- CVE-2025-26524No Rate Limiting Vulnerability in RupeeWeb trading platformRupeeseed Technology Ventures RupeeWeb
- CVE-2025-0821Bit Assist <= 1.5.2 - Authenticated (Subscriber+) SQL Injection via id Parameterbitpressadmin Chat Widget: Floating Customer Support Button…
- CVE-2024-13791Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Functionbitpressadmin Chat Widget: Floating Customer Support Button…
- CVE-2024-13735HurryTimer <= 2.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Namenlemsieh HurryTimer – An Scarcity and Urgency Countdown Tim…
- CVE-2024-9601Qubely – Advanced Gutenberg Blocks <= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID'themeum Qubely – Advanced Gutenberg Blocks
- CVE-2024-7052Forminator < 1.38.3 - Admin+ Stored XSSForminator Forms
- CVE-2024-13493Sensly Online Presence <= 0.6 - Admin+ Stored XSSSensly Online Presence
- CVE-2024-13692Return Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Referencewpswings Return Refund and Exchange For WooCommerce
- CVE-2024-13641Return Refund and Exchange For WooCommerce <= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directorywpswings Return Refund and Exchange For WooCommerce
- CVE-2025-23406Out-of-bounds read vulnerability caused by improper checking of TCP MSS option values exists in Cente middleware TCP/IP Network Series, whicDMG MORI Digital Co., LTD. and NXTech Co. Cente TCP/IPv4 ·…
- CVE-2024-10404Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsaveBrocade SANnav
- CVE-2024-57725An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value without authentication,
- CVE-2024-57790IXON B.V.
- CVE-2024-57969app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search.MISP
- CVE-2025-25740D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the PSK parameter in the SetQuickVPNSe
- CVE-2025-25988Cross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custom Link title paramet
- CVE-2025-25990Cross Site Scripting vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php c
- CVE-2025-25991SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php componen
- CVE-2025-25992SQL Injection vulnerability in FeMiner wms 1.0 allows a remote attacker to obtain sensitive information via the inquire_inout_item.php compo
- CVE-2025-25993SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameter "itemid."
- CVE-2025-26157A SQL Injection vulnerability was found in /bpms/index.php in Source Code and Project Beauty Parlour Management System V1.1, which allows re
- CVE-2025-26158A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the manage-employee.php page of Kashipara Online Attendance Management S
- CVE-2025-26789An issue was discovered in Logpoint AgentX before 1.5.0.Logpoint AgentX
- CVE-2025-26791DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).Cure53 DOMPurify · dompurify