# CVEs published 2025-02-18

162 CVEs were published on February 18, 2025: 24 critical, 44 high. Days are UTC.

- [CVE-2024-13508](https://cve.now/CVE-2024-13508.md): Booking Package \<= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter (CVSS 6.1, masaakitanaka Booking Package)
- [CVE-2025-26624](https://cve.now/CVE-2025-26624.md): Local Privilege Escalation in Rufus 4.6 and previous versions (CVSS 6.8, pbatard rufus)
- [CVE-2024-13743](https://cve.now/CVE-2024-13743.md): Wonder Video Embed \<= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wonderplugin Wonder Video Embed)
- [CVE-2025-26605](https://cve.now/CVE-2025-26605.md): SQL Injection endpoint 'deletar\_cargo.php' parameter 'id\_cargo' in WeGIA (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-26606](https://cve.now/CVE-2025-26606.md): SQL Injection endpoint 'informacao\_adicional.php' parameter 'id\_descricao' in WeGIA (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-26607](https://cve.now/CVE-2025-26607.md): SQL Injection endpoint 'documento\_excluir.php' parameter 'id\_funcionario' in WeGIA (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-26608](https://cve.now/CVE-2025-26608.md): SQL Injection endpoint 'dependente\_docdependente.php' parameter 'id\_dependente', 'id\_doc' in WeGIA (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-26609](https://cve.now/CVE-2025-26609.md): SQL Injection endpoint 'familiar\_docfamiliar.php' parameter 'id\_dependente', 'id\_doc' in WeGIA (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-26610](https://cve.now/CVE-2025-26610.md): SQL Injection endpoint 'restaurar\_produto\_desocultar.php' parameter 'id\_produto' in WeGIA (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-26611](https://cve.now/CVE-2025-26611.md): SQL Injection endpoint 'remover\_produto.php' parameter 'id\_produto' in WeGIA (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-26612](https://cve.now/CVE-2025-26612.md): SQL Injection endpoint 'adicionar\_almoxarife.php' parameter 'id\_almoxarifado', 'id\_funcionario' in WeGIA (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-26613](https://cve.now/CVE-2025-26613.md): OS Command Injection endpoint 'gerenciar\_backup.php' parameter 'file' (RCE) in WeGIA (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-26614](https://cve.now/CVE-2025-26614.md): SQL Injection endpoint 'deletar\_documento.php' parameter 'id\_cargo' in WeGIA (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-26615](https://cve.now/CVE-2025-26615.md): Path Traversal endpoint 'examples.php' parameter 'src' in WeGIA (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-26616](https://cve.now/CVE-2025-26616.md): Path Traversal endpoint 'exportar\_dump.php' parameter 'file' in WeGIA (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-26617](https://cve.now/CVE-2025-26617.md): SQL Injection endpoint 'historico\_paciente.php' parameter 'id\_fichamedica' in WeGIA (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-22663](https://cve.now/CVE-2025-22663.md): WordPress Paid Videochat Turnkey Site plugin \<= 7.2.12 - Arbitrary File Deletion vulnerability (CVSS 8.6, videowhisper Paid Videochat Turnkey Site)
- [CVE-2025-22657](https://cve.now/CVE-2025-22657.md): WordPress Atarim plugin \<= 4.0.9 - Arbitrary Content Deletion vulnerability (CVSS 7.5, Vito Peleg Atarim)
- [CVE-2025-22656](https://cve.now/CVE-2025-22656.md): WordPress Cookie Monster Plugin \<= 1.2.2 - Local File Inclusion vulnerability (CVSS 8.1, Oscar Alvarez Cookie Monster)
- [CVE-2025-22654](https://cve.now/CVE-2025-22654.md): WordPress Simplified Plugin Plugin \<= 1.0.6 - Arbitrary File Upload vulnerability (CVSS 10.0, kodeshpa Simplified)
- [CVE-2025-22650](https://cve.now/CVE-2025-22650.md): WordPress Smartarget.online Integration plugin \<= 1.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Erez Hadas-Sonnenschein Smartarget)
- [CVE-2025-22645](https://cve.now/CVE-2025-22645.md): WordPress Real Estate Manager plugin \<= 7.3 - Captcha Bypass Vulnerability vulnerability (CVSS 5.3, Rameez Iqbal Real Estate Manager)
- [CVE-2025-22639](https://cve.now/CVE-2025-22639.md): WordPress Distance Rate Shipping for WooCommerce plugin \<= 1.3.4 - SQL Injection vulnerability (CVSS 8.5, Techspawn Distance Rate Shipping for WooCommerce)
- [CVE-2024-56000](https://cve.now/CVE-2024-56000.md): WordPress K Elements plugin \< 5.4.0 - Unauthenticated Account Takeover vulnerability (CVSS 9.8, SeventhQueen K Elements)
- [CVE-2025-27016](https://cve.now/CVE-2025-27016.md): WordPress Drivr Lite – Google Drive Plugin plugin \<= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, awsm.in Drivr Lite – Google Drive Plugin)
- [CVE-2025-27013](https://cve.now/CVE-2025-27013.md): WordPress MediCenter theme \< 14.7 - Sensitive Data Exposure vulnerability (CVSS 5.3, QuanticaLabs MediCenter - Health Medical Clinic)
- [CVE-2025-0622](https://cve.now/CVE-2025-0622.md): Grub2: command/gpg: use-after-free due to hooks not being removed on module unload (CVSS 6.4, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2024-45783](https://cve.now/CVE-2024-45783.md): Grub2: fs/hfs+: refcount can be decremented twice (CVSS 4.4, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2024-45781](https://cve.now/CVE-2024-45781.md): Grub2: fs/ufs: oob write in the heap (CVSS 6.7, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2024-45776](https://cve.now/CVE-2024-45776.md): Grub2: grub-core/gettext: integer overflow leads to heap oob write and read. (CVSS 6.7, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2024-45775](https://cve.now/CVE-2024-45775.md): Grub2: commands/extcmd: missing check for failed allocation (CVSS 5.2, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2025-26623](https://cve.now/CVE-2025-26623.md): Use After Free in Exiv2 (CVSS 5.3, exiv2)
- [CVE-2025-26604](https://cve.now/CVE-2025-26604.md): Possibility to retrieve bot token by malicious module developers in Discord-Bot-Framework-Kernel (CVSS 8.3, Discord-Agora Kernel)
- [CVE-2025-26603](https://cve.now/CVE-2025-26603.md): heap-use-after-free in function str\_to\_reg in vim/vim (CVSS 4.2, vim)
- [CVE-2025-25305](https://cve.now/CVE-2025-25305.md): SSL validation for outgoing requests in Home Assistant Core and used libs not correct (CVSS 7.0, home-assistant core · homeassistant)
- [CVE-2025-25284](https://cve.now/CVE-2025-25284.md): Path Traversal and Local File Read via VRT (Virtual Format) in ZOO-Project WPS Implementation (CVSS 8.7, ZOO-Project)
- [CVE-2025-24895](https://cve.now/CVE-2025-24895.md): SAML Response Signature Verification Bypass in CIE.AspNetCore.Authentication (CVSS 9.1, italia cie-aspnetcore · CIE.AspNetCore.Authentication)
- [CVE-2025-24894](https://cve.now/CVE-2025-24894.md): SAML Response Signature Verification Bypass in SPID.AspNetCore.Authentication (CVSS 9.1, italia spid-aspnetcore · SPID.AspNetCore.Authentication)
- [CVE-2025-26465](https://cve.now/CVE-2025-26465.md): Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled (CVSS 6.8, OpenSSH · Red Hat Enterprise Linux +2)
- [CVE-2024-45774](https://cve.now/CVE-2024-45774.md): Grub2: reader/jpeg: heap oob write during jpeg parsing (CVSS 6.7, grub2 · Red Hat Enterprise Linux +1)
- [CVE-2025-21608](https://cve.now/CVE-2025-21608.md): Forged packets over MQTT can show up in direct messages in Meshtastic firmware (CVSS 5.3, meshtastic firmware)
- [CVE-2024-4028](https://cve.now/CVE-2024-4028.md): Keycloak-core: stored xss in keycloak when creating a items in admin console (CVSS 3.8, keycloak · Red Hat Build of Keycloak +2)
- [CVE-2025-25300](https://cve.now/CVE-2025-25300.md): smartbanner.js rel noopener XSS vulnerability (CVSS 1.3, ain smartbanner.js · smartbanner.js)
- [CVE-2025-26620](https://cve.now/CVE-2025-26620.md): Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens (CVSS 6.3, DuendeSoftware foss · Duende.AccessTokenManagement)
- [CVE-2024-49589](https://cve.now/CVE-2024-49589.md): Foundry artifacts denial of service (CVSS 6.5, com.palantir.artifacts:artifacts)
- [CVE-2025-22207](https://cve.now/CVE-2025-22207.md): \[20250201\] - Core - SQL injection vulnerability in Scheduled Tasks component (CVSS 6.7, Joomla! Project Joomla! CMS)
- [CVE-2025-21703](https://cve.now/CVE-2025-21703.md): netem: Update sch-\>q.qlen before qdisc\_tree\_reduce\_backlog() (CVSS 7.8, Linux)
- [CVE-2025-21702](https://cve.now/CVE-2025-21702.md): pfifo\_tail\_enqueue: Drop new packet when sch-\>limit == 0 (CVSS 7.8, Linux)
- [CVE-2024-13689](https://cve.now/CVE-2024-13689.md): Uncode Core \<= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode\_get\_medias (CVSS 6.3, undsgn Uncode Core)
- [CVE-2025-1269](https://cve.now/CVE-2025-1269.md): Open Redirect in HAVELSAN's Open Source Project Liman MYS (CVSS 4.8, HAVELSAN Liman MYS)
- [CVE-2025-1414](https://cve.now/CVE-2025-1414.md): Memory safety bugs fixed in Firefox 135.0.1 (CVSS 6.5, Mozilla Firefox)
- [CVE-2025-1035](https://cve.now/CVE-2025-1035.md): Path Traversal in Komtera Technolgies' KLog Server (CVSS 5.7, Komtera Technolgies KLog Server)
- [CVE-2024-13783](https://cve.now/CVE-2024-13783.md): FormCraft \<= 3.9.11 - Missing Authorization to Plugin Data Export in formcraft-main.php (CVSS 4.3, FormCraft)
- [CVE-2024-13691](https://cve.now/CVE-2024-13691.md): Uncode \<= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode\_recordMedia (CVSS 6.5, undsgn Uncode)
- [CVE-2024-13667](https://cve.now/CVE-2024-13667.md): Uncode \<= 2.9.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description (CVSS 5.4, undsgn Uncode)
- [CVE-2025-0817](https://cve.now/CVE-2025-0817.md): FormCraft - Premium WordPress Form Builder \<= 3.9.11 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload (CVSS 7.2, FormCraft)
- [CVE-2024-13681](https://cve.now/CVE-2024-13681.md): Uncode \<= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode\_admin\_get\_oembed (CVSS 7.5, undsgn Uncode)
- [CVE-2025-0521](https://cve.now/CVE-2025-0521.md): Post SMTP \<= 3.0.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2024-13797](https://cve.now/CVE-2024-13797.md): PressMart - Modern Elementor WooCommerce WordPress Theme \<= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, PressLayouts PressMart - Modern Elementor WooCommerce WordP…)
- [CVE-2025-1023](https://cve.now/CVE-2025-1023.md): SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php (CVSS 9.3, ChurchCRM)
- [CVE-2025-0981](https://cve.now/CVE-2025-0981.md): Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description Field (CVSS 8.4, ChurchCRM)
- [CVE-2024-13369](https://cve.now/CVE-2024-13369.md): Tour Master - Tour Booking, Travel, Hotel \<= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review\_id Parameter (CVSS 6.5, GoodLayers Tour Master - Tour Booking, Travel, Hotel)
- [CVE-2024-13395](https://cve.now/CVE-2024-13395.md): Threepress \<= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, kerryoco Threepress)
- [CVE-2024-12860](https://cve.now/CVE-2024-12860.md): CarSpot – Dealership Wordpress Classified Theme \<= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover (CVSS 9.8, scriptsbundle CarSpot – Dealership Wordpress Classified The…)
- [CVE-2024-13316](https://cve.now/CVE-2024-13316.md): Scratch & Win – Giveaways and Contests \<= 2.8.0 - Missing Authorization to Unauthenticated Coupon Creation (CVSS 5.3, akashmalik Scratch & Win – Giveaways and Contests. Boost su…)
- [CVE-2024-13718](https://cve.now/CVE-2024-13718.md): Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later \<= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/Modification (CVSS 4.3, wpdesk Flexible Wishlist for WooCommerce – Ecommerce Wishli…)
- [CVE-2025-0425](https://cve.now/CVE-2025-0425.md): Local Privilege Escalation via Config Manipulation (CVSS 8.5, Cordaware bestinformed Infoclient)
- [CVE-2025-0424](https://cve.now/CVE-2025-0424.md): Multiple Authenticated Stored Cross-Site Scripting (CVSS 5.1, Cordaware bestinformed Web)
- [CVE-2025-0423](https://cve.now/CVE-2025-0423.md): Multiple Unauthenticated Stored Cross-Site Scripting (CVSS 5.3, Cordaware bestinformed Web)
- [CVE-2025-0422](https://cve.now/CVE-2025-0422.md): Authenticated Remote Code Execution via ScriptVar (CVSS 8.6, Cordaware bestinformed Web)
- [CVE-2024-13575](https://cve.now/CVE-2024-13575.md): Web Stories Enhancer – Level Up Your Web Stories \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, magazine3 Web Stories Enhancer – Level Up Your Web Stories)
- [CVE-2025-0864](https://cve.now/CVE-2025-0864.md): Active Products Tables for WooCommerce. Use constructor to create tables \<= 1.0.6.6 - Reflected Cross-Site Scripting (CVSS 6.1, realmag777 Active Products Tables for WooCommerce. Use cons…)
- [CVE-2024-13795](https://cve.now/CVE-2024-13795.md): Ecwid by Lightspeed Ecommerce Shopping Cart \<= 6.12.27 - Cross-Site Request Forgery to Send Deactivation Message (CVSS 4.3, Ecwid by Lightspeed Ecommerce Shopping Cart)
- [CVE-2024-13465](https://cve.now/CVE-2024-13465.md): aBlocks – WordPress Gutenberg Blocks \<= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, kodezen aBlocks – Gutenberg Blocks, User Dashboard Builder,…)
- [CVE-2024-11895](https://cve.now/CVE-2024-11895.md): Online Payments – Get Paid with PayPal, Square & Stripe \<= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, vcita Online Payments – Get Paid with PayPal, Square & Stri…)
- [CVE-2024-13704](https://cve.now/CVE-2024-13704.md): Super Testimonials \<= 4.0.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, themepoints Super Testimonial – Testimonial & Customer Revi…)
- [CVE-2024-11376](https://cve.now/CVE-2024-11376.md): s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions \<= 241216 - Reflected Cross-Site Scripting (CVSS 6.1, clavaque s2Member – Excellent for All Kinds of Memberships,…)
- [CVE-2024-13523](https://cve.now/CVE-2024-13523.md): MemorialDay \<= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, shenyanzhi MemorialDay)
- [CVE-2024-57964](https://cve.now/CVE-2024-57964.md): Insecure Loading of Dynamic Link Libraries in HVAC Energy Saving Program (CVSS 7.3, Hitachi HVAC Energy Saving Program)
- [CVE-2024-57963](https://cve.now/CVE-2024-57963.md): Insecure Loading of Dynamic Link Libraries in USB-CONVERTERCABLE DRIVER (CVSS 7.3, Hitachi USB-CONVERTERCABLE DRIVER)
- [CVE-2024-13315](https://cve.now/CVE-2024-13315.md): Shopwarden – Automated WooCommerce monitoring & testing \<= 1.0.11 - Cross-Site Request Forgery to Arbitrary Options Update (CVSS 8.8, Shopwarden – Automated WooCommerce monitoring & testing)
- [CVE-2024-13556](https://cve.now/CVE-2024-13556.md): Affiliate Links: WordPress Plugin for Link Cloaking and Link Management \<= 3.0.1 - Missing Authorization to Unauthenticated Import/Export and PHP Object Injection (CVSS 8.1, wecantrack Affiliate Links – Link Cloaking and Management)
- [CVE-2024-13438](https://cve.now/CVE-2024-13438.md): SpeedSize Image & Video AI-Optimizer \<= 1.5.1 - Cross-Site Request Forgery to Clear Cache (CVSS 4.3, SpeedSize Image & Video AI-Optimizer)
- [CVE-2024-45320](https://cve.now/CVE-2024-45320.md): Out-of-bounds write vulnerability exists in DocuPrint CP225w 01.22.01 and earlier, DocuPrint CP228w 01.22.01 and earlier, DocuPrint CM225fw (CVSS 6.5, FUJIFILM Business Innovation DocuPrint CP225w · FUJIFILM… +2)
- [CVE-2024-13582](https://cve.now/CVE-2024-13582.md): Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, labibahmed42 Simple Pricing Tables For WPBakery Page Builder)
- [CVE-2024-13609](https://cve.now/CVE-2024-13609.md): 1 Click WordPress Migration Plugin – 100% FREE for a limited time \<= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php (CVSS 5.9, 1clickmigration 1 Click Migration & Backup: Free WordPress…)
- [CVE-2024-13464](https://cve.now/CVE-2024-13464.md): Library Bookshelves \<= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, photonicgnostic Library Bookshelves)
- [CVE-2024-13565](https://cve.now/CVE-2024-13565.md): Simple Map No Api \<= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter (CVSS 6.4, shaonback2 Simple Map No Api)
- [CVE-2024-13677](https://cve.now/CVE-2024-13677.md): GetBookingsWp - Appointments & Bookings Plugin Basic Version \<= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover (CVSS 8.8, istmoplugins GetBookingsWP – Appointments Booking Calendar…)
- [CVE-2024-13555](https://cve.now/CVE-2024-13555.md): 1 Click WordPress Migration Plugin – 100% FREE for a limited time \<= 2.2 - Cross-Site Request Forgery to Backup Process Cancellation (CVSS 5.3, 1clickmigration 1 Click Migration & Backup: Free WordPress…)
- [CVE-2024-13622](https://cve.now/CVE-2024-13622.md): File Uploads Addon for WooCommerce \<= 1.7.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 7.5, imagisol File Uploads Addon for WooCommerce)
- [CVE-2024-13848](https://cve.now/CVE-2024-13848.md): Reaction Buttons \<= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, jakob42 Reaction Buttons)
- [CVE-2024-13687](https://cve.now/CVE-2024-13687.md): Team Builder – Meet the Team \<= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, labibahmed42 Team Builder – Meet the Team)
- [CVE-2024-13573](https://cve.now/CVE-2024-13573.md): Zigaform – Form Builder Lite \<= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, softdiscover Zigaform – Form Builder Lite)
- [CVE-2024-12314](https://cve.now/CVE-2024-12314.md): Rapid Cache \<= 1.2.3 - Unauthenticated Cache Poisoning (CVSS 7.2, megaoptim Rapid Cache)
- [CVE-2024-13535](https://cve.now/CVE-2024-13535.md): Actionwear products sync \<= 2.3.2 - Unauthenticated Full Patch Disclosure (CVSS 5.3, marcoingraiti Actionwear products sync)
- [CVE-2024-13576](https://cve.now/CVE-2024-13576.md): Gumlet Video \<= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, adityapatadia Gumlet Video)
- [CVE-2024-13725](https://cve.now/CVE-2024-13725.md): Keap Official Opt-in Forms \<= 2.0.1 - Unauthenticated Limited Local File Inclusion (CVSS 9.8, infusionsoft Keap Official Opt-in Forms)
- [CVE-2024-12525](https://cve.now/CVE-2024-12525.md): Easy MLS Listings Import \<= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, homeasap Easy MLS Listings Import)
- [CVE-2024-13588](https://cve.now/CVE-2024-13588.md): Simplebooklet PDF Viewer and Embedder \<= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, kenkwasnicki Simplebooklet PDF Viewer and Embedder)
- [CVE-2024-13852](https://cve.now/CVE-2024-13852.md): Option Editor \<= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update (CVSS 8.8, backie Option Editor)
- [CVE-2024-13577](https://cve.now/CVE-2024-13577.md): CATS Job Listings \<= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, catssoft CATS Job Listings)
- [CVE-2024-13540](https://cve.now/CVE-2024-13540.md): WooODT Lite – Delivery & pickup date time location for WooCommerce \<= 2.5.1 - Unauthenticated Full Path Dsiclosure (CVSS 5.3, mdalabar WooODT Lite – Delivery & pickup date time location…)
- [CVE-2024-12813](https://cve.now/CVE-2024-12813.md): Open Hours – Easy Opening Hours \<= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, pixelgrade Open Hours – Easy Opening Hours)
- [CVE-2025-0796](https://cve.now/CVE-2025-0796.md): Mortgage Lead Capture System \<= 8.2.11 - Cross-Site Request Forgery to Settings Reset (CVSS 4.3, kevin-brent WPrequal)
- [CVE-2024-13579](https://cve.now/CVE-2024-13579.md): WP-Asambleas \<= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, platcom WP-Asambleas)
- [CVE-2024-13595](https://cve.now/CVE-2024-13595.md): Simple Signup Form \<= 1.6.5 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, pantherius Simple Signup Form)
- [CVE-2024-13501](https://cve.now/CVE-2024-13501.md): WP-FormAssembly \<= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, veerwest WP-FormAssembly)
- [CVE-2024-13684](https://cve.now/CVE-2024-13684.md): Reset \<= 1.6 - Cross-Site Request Forgery to Database Reset (CVSS 8.1, shubhamgrover7256 Reset)
- [CVE-2024-13578](https://cve.now/CVE-2024-13578.md): WP-BibTeX \<= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, zjhzxhz WP-BibTeX)
- [CVE-2025-0805](https://cve.now/CVE-2025-0805.md): Mortgage Calculator / Loan Calculator \<= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mlcalc Mortgage Calculator / Loan Calculator)
- [CVE-2024-13538](https://cve.now/CVE-2024-13538.md): BigBuy Dropshipping Connector for WooCommerce \<= 2.0.0 - Unauthenticated Full Path Disclosute (CVSS 5.3, devsmip BigBuy Dropshipping Connector for WooCommerce)
- [CVE-2024-13581](https://cve.now/CVE-2024-13581.md): Simple Charts \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, supporthost Simple Charts)
- [CVE-2024-13587](https://cve.now/CVE-2024-13587.md): Zigaform – Price Calculator & Cost Estimation Form Builder Lite \<= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, softdiscover Zigaform – Price Calculator & Cost Estimation…)
- [CVE-2024-13522](https://cve.now/CVE-2024-13522.md): magayo Lottery Results \<= 2.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, magayo Lottery Results)
- [CVE-2025-1390](https://cve.now/CVE-2025-1390.md): pam\_cap: Fix potential configuration parsing error (CVSS 6.1, OpenAnolis Anolis OS)
- [CVE-2024-13740](https://cve.now/CVE-2024-13740.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure (CVSS 4.3, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2024-13741](https://cve.now/CVE-2024-13741.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery (CVSS 5.4, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2025-25224](https://cve.now/CVE-2025-25224.md): The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability (CVSS 5.3, LuxSoft The LuxCal Web Calendar)
- [CVE-2025-25223](https://cve.now/CVE-2025-25223.md): The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a path traversal vulnerability in dloa (CVSS 5.8, LuxSoft The LuxCal Web Calendar)
- [CVE-2025-25222](https://cve.now/CVE-2025-25222.md): The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retr (CVSS 7.3, LuxSoft The LuxCal Web Calendar)
- [CVE-2025-25221](https://cve.now/CVE-2025-25221.md): The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf. (CVSS 7.3, LuxSoft The LuxCal Web Calendar)
- [CVE-2022-41545](https://cve.now/CVE-2022-41545.md): The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authenticates users via ba (CVSS 6.4)
- [CVE-2024-39327](https://cve.now/CVE-2024-39327.md): Incorrect Access Control vulnerability in Atos Eviden IDRA before 2.6.1 could allow the possibility to obtain CA signing in an illegitimate (CVSS 9.9)
- [CVE-2024-39328](https://cve.now/CVE-2024-39328.md): Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7.0. (CVSS 6.8)
- [CVE-2024-50608](https://cve.now/CVE-2024-50608.md): An issue was discovered in Fluent Bit 3.1.9. (CVSS 7.5)
- [CVE-2024-50609](https://cve.now/CVE-2024-50609.md): An issue was discovered in Fluent Bit 3.1.9. (CVSS 7.5)
- [CVE-2024-51505](https://cve.now/CVE-2024-51505.md): An issue was discovered in Atos Eviden IDRA before 2.7.1. (CVSS 8.0)
- [CVE-2024-55460](https://cve.now/CVE-2024-55460.md): A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allow (CVSS 9.8)
- [CVE-2024-56171](https://cve.now/CVE-2024-56171.md): libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlsc (CVSS 7.8, xmlsoft libxml2)
- [CVE-2024-56882](https://cve.now/CVE-2024-56882.md): Sage DPW before 2024\_12\_000 is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4)
- [CVE-2024-56883](https://cve.now/CVE-2024-56883.md): Sage DPW before 2024\_12\_001 is vulnerable to Incorrect Access Control. (CVSS 8.1)
- [CVE-2024-57045](https://cve.now/CVE-2024-57045.md): A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authen (CVSS 9.8)
- [CVE-2024-57046](https://cve.now/CVE-2024-57046.md): A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the aut (CVSS 8.8)
- [CVE-2024-57055](https://cve.now/CVE-2024-57055.md): Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potentially call certain serv (CVSS 5.0)
- [CVE-2024-57056](https://cve.now/CVE-2024-57056.md): Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could b (CVSS 5.4)
- [CVE-2024-57254](https://cve.now/CVE-2024-57254.md): An integer overflow in sqfs\_inode\_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesy (CVSS 7.1, denx U-Boot)
- [CVE-2024-57255](https://cve.now/CVE-2024-57255.md): An integer overflow in sqfs\_resolve\_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of (CVSS 7.1, denx U-Boot)
- [CVE-2024-57256](https://cve.now/CVE-2024-57256.md): An integer overflow in ext4fs\_read\_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted (CVSS 7.1, denx U-Boot)
- [CVE-2024-57257](https://cve.now/CVE-2024-57257.md): A stack consumption issue in sqfs\_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting. (CVSS 2.0, denx U-Boot)
- [CVE-2024-57258](https://cve.now/CVE-2024-57258.md): Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, (CVSS 7.1, denx U-Boot)
- [CVE-2024-57259](https://cve.now/CVE-2024-57259.md): sqfs\_search\_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory li (CVSS 7.1, denx U-Boot)
- [CVE-2025-22919](https://cve.now/CVE-2025-22919.md): A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a cra (CVSS 6.5)
- [CVE-2025-22920](https://cve.now/CVE-2025-22920.md): A heap buffer overflow vulnerability in FFmpeg before commit 4bf784c allows attackers to trigger a memory corruption via supplying a crafted (CVSS 5.3)
- [CVE-2025-22921](https://cve.now/CVE-2025-22921.md): FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c. (CVSS 6.5)
- [CVE-2025-24928](https://cve.now/CVE-2025-24928.md): libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. (CVSS 7.8, xmlsoft libxml2)
- [CVE-2025-25467](https://cve.now/CVE-2025-25467.md): Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a (CVSS 9.8)
- [CVE-2025-25468](https://cve.now/CVE-2025-25468.md): FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c. (CVSS 6.5)
- [CVE-2025-25469](https://cve.now/CVE-2025-25469.md): FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c. (CVSS 6.5)
- [CVE-2025-25471](https://cve.now/CVE-2025-25471.md): FFmpeg git master before commit fd1772 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c. (CVSS 4.3)
- [CVE-2025-25472](https://cve.now/CVE-2025-25472.md): A buffer overflow in DCMTK git master v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DCM file. (CVSS 5.3)
- [CVE-2025-25473](https://cve.now/CVE-2025-25473.md): FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat\_free\_context function in libavutil/mem.c. (CVSS 5.3)
- [CVE-2025-25474](https://cve.now/CVE-2025-25474.md): DCMTK v3.6.9+ DEV was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h. (CVSS 6.5)
- [CVE-2025-25475](https://cve.now/CVE-2025-25475.md): A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via (CVSS 7.5)
- [CVE-2025-25891](https://cve.now/CVE-2025-25891.md): A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01, triggered by the destination, netmask and gateway parameters. (CVSS 5.7)
- [CVE-2025-25892](https://cve.now/CVE-2025-25892.md): A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the sstartip, sendip, dstartip, and dendip parameters. (CVSS 5.7)
- [CVE-2025-25893](https://cve.now/CVE-2025-25893.md): An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the inIP, insPort, inePort, exsPort, exePort, and protocol (CVSS 8.0)
- [CVE-2025-25894](https://cve.now/CVE-2025-25894.md): An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the samba\_wg and samba\_nbn parameters. (CVSS 8.0)
- [CVE-2025-25895](https://cve.now/CVE-2025-25895.md): An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the public\_type parameter. (CVSS 8.0)
- [CVE-2025-25896](https://cve.now/CVE-2025-25896.md): A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the destination, netmask, and gateway parameters. (CVSS 5.7)
- [CVE-2025-26058](https://cve.now/CVE-2025-26058.md): Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. (CVSS 4.2)
- [CVE-2025-27113](https://cve.now/CVE-2025-27113.md): libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c. (CVSS 2.9, xmlsoft libxml2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.