CVEs published February 24, 2025
118 CVEs were published on February 24, 2025: 13 critical, 24 high.
- Published
- 118
- Critical
- 13
- High
- 24
- Medium
- 77
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- Moodle Project moodle · moodle/moodle
- 9
- FiberHome AN5506-01A ONU GPON
- 4
- LB-LINK AC1900 Router
- 3
- Mattermost · github.com/mattermost/mattermost-server +3
- 3
- Agito Computer Health4All
- 2
- LabRedesCefetRJ WeGIA
- 2
- SourceCodester Best Employee Management System
- 2
- Aaron D. Campbell Google Maps for WordPress
- 1
- Achal Jain Table of Contents Block
- 1
- afzal_du Reactive Mortgage Calculator
- 1
Critical 13
- CVE-2025-27140WeGIA vulnerable to OS Command Injection at endpoint 'importar_dump.php' parameter 'import' (RCE)LabRedesCefetRJ WeGIA
- CVE-2025-27133WeGIA has SQL Injection endpoint at 'dao/pet/adicionar_tipo_exame.php' parameter 'tipo_exame'LabRedesCefetRJ WeGIA
- CVE-2025-20051Arbitrary file read via block duplication in Mattermost BoardsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-24490SQL Injection in Mattermost Boards via board category ID reorderingMattermost
- CVE-2025-25279Arbitrary file read in Mattermost Boards via import & export board archiveMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-53544NovaCHRON Zeitsysteme GmbH & Co.
- CVE-2024-54820XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page.
- CVE-2024-56525In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can c
- CVE-2024-56897Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands.
- CVE-2025-22974SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter i
- CVE-2025-25513Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.
- CVE-2025-26201Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attackers to bypass authent
- CVE-2025-27364In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implantMITRE Caldera
High 24
- CVE-2025-26533SQL injection risk in course search module list filterMoodle Project moodle · moodle/moodle
- CVE-2025-26530Reflected XSS via question bank filterMoodle Project moodle · moodle/moodle
- CVE-2025-26529Stored XSS risk in admin live logMoodle Project moodle · moodle/moodle
- CVE-2025-26525Arbitrary file read risk through pdfTeXMoodle Project moodle · moodle/moodle
- CVE-2025-22495An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card.Eaton Network M2
- CVE-2025-27355WordPress Woocommerce – Loi Hamon Plugin <= 1.1.0 - CSRF to Stored XSS vulnerabilityNicolas GRILLET Woocommerce – Loi Hamon
- CVE-2025-27352WordPress 无觅相关文章插件 plugin <= 1.0.5.7 - CSRF to Cross Site Scripting (XSS) vulnerabilitywumii team 无觅相关文章插件
- CVE-2025-27332WordPress Smart Maintenance & Countdown Plugin <= 1.2 - CSRF to Stored XSS vulnerabilitygmnazmul Smart Maintenance & Countdown
- CVE-2025-27321WordPress Blightly Explorer plugin <= 2.3.0 - CSRF to Stored XSS vulnerabilityBlighty Blightly Explorer
- CVE-2025-27312WordPress WP Sitemap plugin <= 1.0 - SQL Injection vulnerabilityJenst WP Sitemap
- CVE-2025-27301WordPress NHR Options Table Manager Plugin <= 1.1.2 - Deserialization of untrusted data vulnerabilityNazmul Hasan Robin NHR Options Table Manager
- CVE-2025-27300WordPress ADFO plugin <= 1.9.1 - Deserialization of untrusted data vulnerabilitygiuliopanda ADFO
- CVE-2025-27298WordPress WP Video Posts plugin <= 3.5.1 - CSRF to Remote Code Execution (RCE) vulnerabilitycmstactics WP Video Posts
- CVE-2025-27297WordPress Bravo Search & Replace Plugin <= 1.0 - SQL Injection vulnerabilityguelben Bravo Search & Replace
- CVE-2025-27296WordPress Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue Plugin <= 1.5 - Settings Change vulnerabilityrevenueflex Auto Ad Inserter – Increase Google Adsense and…
- CVE-2025-27277WordPress Add Linked Images To Gallery plugin <= 1.4 - CSRF to Stored XSS vulnerabilitytiefpunkt Add Linked Images To Gallery
- CVE-2025-27276WordPress Photo Gallery ( Responsive ) plugin <= 4.0 - CSRF to Privilege Escalation vulnerabilitylizeipe Photo Gallery
- CVE-2025-27272WordPress VG PostCarousel plugin <= 1.1 - Local File Inclusion vulnerabilityvinagecko VG PostCarousel
- CVE-2024-12918SQLi in Agito Computer's Health4AllAgito Computer Health4All
- CVE-2024-12917Improper Access Control in Agito Computer's Health4AllAgito Computer Health4All
- CVE-2024-12916SQLi in Agito Computer's Life4AllAgito Computer Life4All
- CVE-2023-52926io_uring/rw: split io_read() into a helperLinux
- CVE-2024-55898IBM i privilege escalationIBM i
- CVE-2025-26200SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php compone
Medium, low and unrated 81
- CVE-2025-27144Go JOSE's Parsing Vulnerable to Denial of Servicego-jose · github.com/go-jose/go-jose +3
- CVE-2025-27143Beter Auth has an Open Redirect via Scheme-Less Callback Parameterbetter-auth
- CVE-2025-27141Metabase Enterprise Edition allows cached questions to leak data to impersonated usersmetabase
- CVE-2025-27137Dependency-Track vulnerable to local file inclusion via custom notification templatesDependencyTrack dependency-track
- CVE-2025-26532Teachers can evade trusttext config when restoring glossary entriesMoodle Project moodle · moodle/moodle
- CVE-2025-26531IDOR in badges allows disabling of arbitrary badgesMoodle Project moodle · moodle/moodle
- CVE-2025-26528Stored XSS in ddimageortext question typeMoodle Project moodle · moodle/moodle
- CVE-2025-26527Non-searchable tags can still be discovered on the tag search page and in the tags blockMoodle Project moodle · moodle/moodle
- CVE-2025-26526Feedback response viewing and deletions did not respect Separate Groups modeMoodle Project moodle · moodle/moodle
- CVE-2025-27112Navidrome has authentication bypass in Subsonic API with non-existent usernamenavidrome · github.com/navidrome/navidrome
- CVE-2025-27357WordPress Önceki Yazı Link Plugin <= 1.3 - Cross Site Request Forgery (CSRF) vulnerabilityMusa AVCI Önceki Yazı Link
- CVE-2025-27356WordPress Sticky Header On Scroll plugin <= 1.0 - Broken Access Control vulnerabilityHardik Sticky Header On Scroll
- CVE-2025-27353WordPress Namaste! LMS Plugin <= 2.6.5 - Cross Site Request Forgery (CSRF) vulnerabilityBob Namaste! LMS
- CVE-2025-27351WordPress Local Search SEO Contact Page plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityExpertBusinessSearch Local Search SEO Contact Page
- CVE-2025-27349WordPress Get Posts plugin <= 0.6 - Stored Cross Site Scripting (XSS) vulnerabilitynurelm Get Posts
- CVE-2025-27348WordPress WP Social SEO Booster plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityDaniel WP Social SEO Booster – Knowledge Graph Social Signa…
- CVE-2025-27347WordPress Direct Checkout Button for WooCommerce plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitytechmix Direct Checkout Button for WooCommerce
- CVE-2025-27344WordPress Phee's LinkPreview Plugin <= 1.6.7 - Cross Site Request Forgery (CSRF) vulnerabilityfilipstepanov Phee's LinkPreview
- CVE-2025-27342WordPress WooCommerce Recargo de Equivalencia Plugin <= 1.6.24 - Cross Site Request Forgery (CSRF) vulnerabilityjosesan WooCommerce Recargo de Equivalencia
- CVE-2025-27341WordPress Reactive Mortgage Calculator plugin <= 1.1 - Stored Cross Site Scripting (XSS) vulnerabilityafzal_du Reactive Mortgage Calculator
- CVE-2025-27340WordPress F12-Profiler Plugin <= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerabilityForge12 Interactive F12-Profiler
- CVE-2025-27339WordPress Minimum Password Strength Plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerabilityWill Anderson Minimum Password Strength
- CVE-2025-27336WordPress Just Variables Plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) vulnerabilityAlex Prokopenko / JustCoded Just Variables
- CVE-2025-27335WordPress Auto Tag Links Plugin <= 1.0.13 - Cross Site Request Forgery (CSRF) vulnerabilityFree plug in by SEO Roma Auto Tag Links
- CVE-2025-27331WordPress WooCommerce Display Products by Tags plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilitySébastien Dumont WooCommerce Display Products by Tags
- CVE-2025-27330WordPress PlayerJS plugin <= 2.23 - Cross Site Scripting (XSS) vulnerabilityPlayerJS
- CVE-2025-27329WordPress EZ InLinkz linkup plugin <= 0.18 - Cross Site Scripting (XSS) vulnerabilityEZ InLinkz linkup
- CVE-2025-27328WordPress WP-PostRatings Cheater Plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerabilityqueeez WP-PostRatings Cheater
- CVE-2025-27327WordPress Live Streaming Video Player – by SRS Player plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerabilityWinlin Live Streaming Video Player – by SRS Player
- CVE-2025-26883WordPress Animated Text Block plugin <= 1.0.7 - Broken Access Control vulnerabilitybPlugins Animated Text Block
- CVE-2025-27325WordPress Video.js HLS Player plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityBruce Video.js HLS Player
- CVE-2025-27323WordPress WP About Author plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityJon Bishop WP About Author
- CVE-2025-27320WordPress Profile Widget Ninja plugin <= 4.3 - Cross Site Scripting (XSS) vulnerabilityPankaj Mondal Profile Widget Ninja
- CVE-2025-27318WordPress Simple Google Sitemap Plugin <= 1.6 - Cross Site Request Forgery (CSRF) vulnerabilityixiter Simple Google Sitemap
- CVE-2025-27317WordPress RAYS Grid Plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityIT-RAYS RAYS Grid
- CVE-2025-27316WordPress JPG, PNG Compression and Optimization Plugin <= 1.7.35 - Cross Site Request Forgery (CSRF) vulnerabilityhosting.io JPG, PNG Compression and Optimization
- CVE-2025-27315WordPress All-In-One Cufon Plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerabilitywptom All-In-One Cufon
- CVE-2025-27311WordPress Bulk Content Creator Plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityluk3thomas Bulk Content Creator
- CVE-2025-27307WordPress Quotes llama plugin <= 3.0.1 - Stored Cross Site Scripting (XSS) vulnerabilityoooorgle Quotes llama
- CVE-2025-27306WordPress Pathomation plugin <= 2.5.1 - Stored Cross Site Scripting (XSS) vulnerabilityPathomation
- CVE-2025-27305WordPress Table of Contents Block plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityAchal Jain Table of Contents Block
- CVE-2025-27304WordPress Contact Form 7 Star Rating with font Awesome plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilitythemelogger Contact Form 7 Star Rating with font Awesome
- CVE-2025-27303WordPress Contact Form 7 Star Rating plugin <= 1.10 - Cross Site Scripting (XSS) vulnerabilitythemelogger Contact Form 7 Star Rating
- CVE-2025-27294WordPress WP-Asambleas plugin <= 2.85.0 - Arbitrary Shortcode Execution vulnerabilityplatcom WP-Asambleas
- CVE-2025-27290WordPress Select Erima Zarinpal Donate Plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerabilityseyyed-amir Erima Zarinpal Donate
- CVE-2025-27280WordPress Archive Page plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityAlobaidi Archive Page
- CVE-2025-27266WordPress Hover Image Button plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityIgnacio Perez Hover Image Button
- CVE-2025-27265WordPress Google Maps for WordPress plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityAaron D. Campbell Google Maps for WordPress
- CVE-2025-0545XSS in Tekrom Technology's T-Soft E-CommerceTekrom Technology T-Soft E-Commerce
- CVE-2024-5174Broken Authentication in GliffyGliffy Online
- CVE-2025-1632libarchive bsdunzip.c list null pointer dereferencelibarchive
- CVE-2025-1488WPO365 | MICROSOFT 365 GRAPH MAILER <= 3.2 - Open Redirect via 'redirect_to' ParameterWPO365 | MICROSOFT 365 GRAPH MAILER
- CVE-2025-0690Grub2: read: integer overflow may lead to out-of-bounds writegrub2 · Red Hat Enterprise Linux +1
- CVE-2025-1412Session Persistence After User-to-Bot ConversionMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-24526Channel export permitted on archived channel when viewing archived channels is disabledMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-13822Total Contest Lite <= 2.8.1 - Reflected XSSPhoto Contest | Competition | Video Contest
- CVE-2024-13605Form Maker by 10Web < 1.15.33 - Admin+ Stored XSSForm Maker by 10Web
- CVE-2024-12308Logo Slider < 4.6.0 - Contributor+ Stored XSSLogo Slider
- CVE-2025-1629Excitel Broadband Private my Excitel App One-Time Password excessive authenticationExcitel Broadband Private my Excitel App
- CVE-2025-1618vTiger CRM index.php cross site scriptingvTiger CRM
- CVE-2025-1617Netis WF2780 Wireless 2.4G Menu cross site scriptingNetis WF2780
- CVE-2025-1616FiberHome AN5506-01A ONU GPON Diagnosis os command injectionFiberHome AN5506-01A ONU GPON
- CVE-2025-1615FiberHome AN5506-01A ONU GPON NAT Submenu cross site scriptingFiberHome AN5506-01A ONU GPON
- CVE-2025-1614FiberHome AN5506-01A ONU GPON Port Forwarding Submenu portForwardingCfg cross site scriptingFiberHome AN5506-01A ONU GPON
- CVE-2025-1613FiberHome AN5506-01A ONU GPON URL Filtering Submenu URL_filterCfg cross site scriptingFiberHome AN5506-01A ONU GPON
- CVE-2025-1612Edimax BR-6288ACL wireless5g_basic.asp cross site scriptingEdimax BR-6288ACL
- CVE-2025-1611ShopXO Template ThemeAdminService.php injectionShopXO
- CVE-2025-1610LB-LINK AC1900 Router set_blacklist websGetVar os command injectionLB-LINK AC1900 Router
- CVE-2025-1609LB-LINK AC1900 Router set_cmd websGetVar os command injectionLB-LINK AC1900 Router
- CVE-2025-1608LB-LINK AC1900 Router set_manpwd websGetVar os command injectionLB-LINK AC1900 Router
- CVE-2025-1607SourceCodester Best Employee Management System salary_slip.php authorizationSourceCodester Best Employee Management System
- CVE-2025-1606SourceCodester Best Employee Management System backups.php information disclosureSourceCodester Best Employee Management System
- CVE-2025-1599SourceCodester Best Church Management Software profile_crud.php path traversalSourceCodester Best Church Management Software
- CVE-2024-53542Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co.
- CVE-2024-53543NovaCHRON Zeitsysteme GmbH & Co.
- CVE-2024-57026TawkTo Widget Version <= 1.3.7 is vulnerable to Cross Site Scripting (XSS) due to processing user input in a way that allows JavaScript exec
- CVE-2024-57608An issue in Via Browser 6.1.0 allows a a remote attacker to execute arbitrary code via the mark.via.Shell component.
- CVE-2024-57685An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar file.
- CVE-2025-23017WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attaWorkOS Hosted AuthKit
- CVE-2025-25460A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature.
- CVE-2025-26803The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invaPhusion Passenger · passenger