# CVEs published 2025-02-16

40 CVEs were published on February 16, 2025: 2 critical, 10 high. Days are UTC.

- [CVE-2025-0591](https://cve.now/CVE-2025-0591.md): Out-of-bounds Read vulnerability in CX-Programmer (CVSS 7.8, OMRON FA Integrated Tool Package CX-One)
- [CVE-2025-1365](https://cve.now/CVE-2025-1365.md): GNU elfutils eu-readelf readelf.c process\_symtab buffer overflow (CVSS 4.8, GNU elfutils)
- [CVE-2025-1364](https://cve.now/CVE-2025-1364.md): MicroWord eScan Antivirus USB Protection Service passPrompt stack-based overflow (CVSS 4.8, MicroWord eScan Antivirus)
- [CVE-2025-26779](https://cve.now/CVE-2025-26779.md): WordPress Keep Backup Daily plugin \<= 2.1.0 - Arbitrary File Download vulnerability (CVSS 4.9, Fahad Mahmood Keep Backup Daily)
- [CVE-2025-26768](https://cve.now/CVE-2025-26768.md): WordPress what3words Address Field plugin \<= 4.0.15 - CSRF to Stored XSS vulnerability (CVSS 7.1, what3words Address Field)
- [CVE-2025-26767](https://cve.now/CVE-2025-26767.md): WordPress Qubely plugin \<= 1.8.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themeum Qubely)
- [CVE-2025-26766](https://cve.now/CVE-2025-26766.md): WordPress Leyka plugin \<= 3.31.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, VaultDweller Leyka)
- [CVE-2025-26765](https://cve.now/CVE-2025-26765.md): WordPress Distance Based Shipping Calculator plugin \<= 2.0.22 - Broken Access Control vulnerability (CVSS 5.4, enituretechnology Distance Based Shipping Calculator)
- [CVE-2025-26761](https://cve.now/CVE-2025-26761.md): WordPress Easy Elementor Addons plugin \<= 2.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, hashthemes Easy Elementor Addons)
- [CVE-2025-26759](https://cve.now/CVE-2025-26759.md): WordPress Content Snippet Manager plugin \<= 1.1.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, alexvtn Content Snippet Manager)
- [CVE-2025-26755](https://cve.now/CVE-2025-26755.md): WordPress WP Airbnb Review Slider Plugin \<= 3.9 - SQL Injection vulnerability (CVSS 7.6, jgwhite33 WP Airbnb Review Slider)
- [CVE-2025-23975](https://cve.now/CVE-2025-23975.md): WordPress Botnet Attack Blocker plugin \<= 2.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, cheesefather Botnet Attack Blocker)
- [CVE-2025-22689](https://cve.now/CVE-2025-22689.md): WordPress Forex Calculators plugin \<= 1.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Levan Tarbor Forex Calculators)
- [CVE-2025-22680](https://cve.now/CVE-2025-22680.md): WordPress Ad Inserter Pro plugin \<= 2.7.39 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NotFound Ad Inserter Pro)
- [CVE-2025-22676](https://cve.now/CVE-2025-22676.md): WordPress Upcasted S3 Offload plugin \<= 3.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, AWS S3 for WordPress Plugin – Upcasted)
- [CVE-2025-22291](https://cve.now/CVE-2025-22291.md): WordPress LTL Freight Quotes – Worldwide Express Edition plugin \<= 5.0.20 - Arbitrary Content Deletion vulnerability (CVSS 5.3, enituretechnology LTL Freight Quotes – Worldwide Express Ed…)
- [CVE-2025-22290](https://cve.now/CVE-2025-22290.md): WordPress LTL Freight Quotes – FreightQuote Edition Plugin \<= 2.3.11 - SQL Injection vulnerability (CVSS 9.3, enituretechnology LTL Freight Quotes – FreightQuote Edition)
- [CVE-2025-22289](https://cve.now/CVE-2025-22289.md): WordPress LTL Freight Quotes – Unishippers Edition plugin \<= 2.5.8 - Broken Access Control vulnerability (CVSS 6.5, enituretechnology LTL Freight Quotes – Unishippers Edition)
- [CVE-2025-22286](https://cve.now/CVE-2025-22286.md): WordPress LTL Freight Quotes – Worldwide Express Edition plugin \<= 5.0.21 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, enituretechnology LTL Freight Quotes – Worldwide Express Ed…)
- [CVE-2025-22284](https://cve.now/CVE-2025-22284.md): WordPress LTL Freight Quotes – Unishippers Edition plugin \<= 2.5.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, enituretechnology LTL Freight Quotes – Unishippers Edition)
- [CVE-2024-44044](https://cve.now/CVE-2024-44044.md): WordPress Oshine Modules plugin \< 3.3.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, brandexponents Oshine Modules)
- [CVE-2025-1360](https://cve.now/CVE-2025-1360.md): Internet Web Solutions Sublime CRM HTTP POST Request inicio.php cross site scripting (CVSS 5.1, Internet Web Solutions Sublime CRM)
- [CVE-2025-1359](https://cve.now/CVE-2025-1359.md): SIAM Industria de Automação e Monitoramento qrcode.jsp cross site scripting (CVSS 5.3, SIAM Industria de Automação e Monitoramento SIAM)
- [CVE-2025-1358](https://cve.now/CVE-2025-1358.md): Pix Software Vivaz cross-site request forgery (CVSS 5.3, Pix Software Vivaz)
- [CVE-2025-1357](https://cve.now/CVE-2025-1357.md): Seventh D-Guard HTTP GET Request path traversal (CVSS 5.3, Seventh D-Guard)
- [CVE-2025-1356](https://cve.now/CVE-2025-1356.md): needyamin Library Card System card.php sql injection (CVSS 5.3, needyamin Library Card System)
- [CVE-2025-1355](https://cve.now/CVE-2025-1355.md): needyamin Library Card System Add Picture signup.php unrestricted upload (CVSS 6.9, needyamin Library Card System)
- [CVE-2025-1354](https://cve.now/CVE-2025-1354.md): A cross-site scripting (XSS) vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . (CVSS 4.8, ASUS RT-N12E · ASUS RT-N10E)
- [CVE-2025-1353](https://cve.now/CVE-2025-1353.md): Kong Insomnia profapi.dll untrusted search path (CVSS 7.3, Kong Insomnia)
- [CVE-2025-1352](https://cve.now/CVE-2025-1352.md): GNU elfutils eu-readelf libdw\_alloc.c \_\_libdw\_thread\_tail memory corruption (CVSS 2.3, GNU elfutils)
- [CVE-2025-1341](https://cve.now/CVE-2025-1341.md): PMWeb Setting weak password (CVSS 6.3, PMWeb)
- [CVE-2025-1340](https://cve.now/CVE-2025-1340.md): TOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflow (CVSS 8.7, TOTOLINK X18)
- [CVE-2025-1339](https://cve.now/CVE-2025-1339.md): TOTOLINK X18 cstecgi.cgi setL2tpdConfig os command injection (CVSS 5.3, TOTOLINK X18)
- [CVE-2025-1338](https://cve.now/CVE-2025-1338.md): NUUO Camera handle\_config.php print\_file command injection (CVSS 6.9, NUUO Camera)
- [CVE-2025-1337](https://cve.now/CVE-2025-1337.md): Eastnets PaymentSafe BIC Search cross site scripting (CVSS 5.1, Eastnets PaymentSafe)
- [CVE-2025-1336](https://cve.now/CVE-2025-1336.md): CmsEasy image\_admin.php deleteimg\_action path traversal (CVSS 5.3, CmsEasy)
- [CVE-2025-1335](https://cve.now/CVE-2025-1335.md): CmsEasy file\_admin.php deleteimg\_action path traversal (CVSS 5.3, CmsEasy)
- [CVE-2025-1332](https://cve.now/CVE-2025-1332.md): FastCMS Template Menu menu cross site scripting (CVSS 4.8, FastCMS)
- [CVE-2024-57970](https://cve.now/CVE-2024-57970.md): libarchive through 3.7.7 has a heap-based buffer over-read in header\_gnu\_longlink in archive\_read\_support\_format\_tar.c via a TAR archive bec (CVSS 4.0, libarchive)
- [CVE-2024-57971](https://cve.now/CVE-2024-57971.md): DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occur (CVSS 9.1, eng KNOWAGE)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.