# CVEs published 2025-02-25

144 CVEs were published on February 25, 2025: 11 critical, 45 high. Days are UTC.

- [CVE-2025-0760](https://cve.now/CVE-2025-0760.md): Stored Credential Disclosure Vulnerability (CVSS 2.7, Tenable Identity Exposure)
- [CVE-2025-1091](https://cve.now/CVE-2025-1091.md): Broken Authorization Schema (CVSS 4.3, Tenable Identity Exposure)
- [CVE-2024-30150](https://cve.now/CVE-2024-30150.md): An unauthenticated privilege escalation vulnerability affects HCL MyCloud (CVSS 5.3, HCL Software MyCloud)
- [CVE-2025-22211](https://cve.now/CVE-2025-22211.md): Extension - webdesigner-profi.de - SQL injection in JoomShopping component version 1.0.0 - 5.5.5 for Joomla (CVSS 3.4, webdesigner-profi.de JoomShopping component for Joomla)
- [CVE-2025-0514](https://cve.now/CVE-2025-0514.md): Executable hyperlink Windows path targets executed unconditionally on activation (CVSS 7.2, The Document Foundation LibreOffice)
- [CVE-2024-53879](https://cve.now/CVE-2024-53879.md): NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a ma (CVSS 2.8, NVIDIA CUDA Toolkit)
- [CVE-2024-53878](https://cve.now/CVE-2024-53878.md): NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a ma (CVSS 2.8, NVIDIA CUDA Toolkit)
- [CVE-2024-27239](https://cve.now/CVE-2024-27239.md): Zoom Workplace Apps and SDKs - Divide By Zero (CVSS 4.3, Zoom Communications Zoom Workplace Apps and SDKs)
- [CVE-2024-27246](https://cve.now/CVE-2024-27246.md): Zoom Workplace Apps and SDKs - Use After Free (CVSS 4.3, Zoom Communications Zoom Workplace Apps and SDKs)
- [CVE-2024-27245](https://cve.now/CVE-2024-27245.md): Zoom Workplace Apps and SDKs - Buffer Overflow (CVSS 4.3, Zoom Communications Zoom Workplace Apps and SDKs)
- [CVE-2024-53877](https://cve.now/CVE-2024-53877.md): NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause a NULL pointer exception by (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2024-53876](https://cve.now/CVE-2024-53876.md): NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by pas (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2024-53875](https://cve.now/CVE-2024-53875.md): NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by pa (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2024-53874](https://cve.now/CVE-2024-53874.md): NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by pa (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2024-53873](https://cve.now/CVE-2024-53873.md): NVIDIA CUDA toolkit for Windows contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2024-53872](https://cve.now/CVE-2024-53872.md): NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by pa (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2024-53871](https://cve.now/CVE-2024-53871.md): NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by pas (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2024-53870](https://cve.now/CVE-2024-53870.md): NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by pa (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2025-27148](https://cve.now/CVE-2025-27148.md): Gradle vulnerable to local privilege escalation through system temporary directory (CVSS 8.8, gradle)
- [CVE-2024-0148](https://cve.now/CVE-2024-0148.md): NVIDIA Jetson Linux and IGX OS image contains a vulnerability in the UEFI firmware RCM boot mode, where an unprivileged attacker with physic (CVSS 7.6, NVIDIA IGX Orin · NVIDIA Jetson AGX Orin Series)
- [CVE-2025-27146](https://cve.now/CVE-2025-27146.md): Matrix IRC Bridge allows IRC command injection to own puppeted user (CVSS 2.7, matrix-org matrix-appservice-irc · matrix-appservice-irc)
- [CVE-2025-27142](https://cve.now/CVE-2025-27142.md): LocalSend path traversal vulnerability in the file upload endpoint allows nearby devices to execute arbitrary commands (CVSS 6.3, localsend)
- [CVE-2025-27110](https://cve.now/CVE-2025-27110.md): Libmodsecurity3 has possible bypass of encoded HTML entities (CVSS 7.9, owasp-modsecurity ModSecurity)
- [CVE-2024-45421](https://cve.now/CVE-2024-45421.md): Zoom Apps - Buffer Overflow (CVSS 8.5, Zoom Communications Zoom Apps)
- [CVE-2024-45418](https://cve.now/CVE-2024-45418.md): Zoom Apps for macOS - Symbolic Link Following (CVSS 5.4, Zoom Communications Zoom Apps for macOS)
- [CVE-2025-27139](https://cve.now/CVE-2025-27139.md): Combodo iTop vulnerable to stored self Cross-site Scripting in preferences (CVSS 6.8, Combodo iTop)
- [CVE-2024-45417](https://cve.now/CVE-2024-45417.md): Zoom Apps for macOS - Uncontrolled Resource Consumption (CVSS 6.0, Zoom Communications Zoom Apps for macOS)
- [CVE-2024-45426](https://cve.now/CVE-2024-45426.md): Zoom Workplace Apps - Incorrect Ownership Assignment (CVSS 4.9, Zoom Communications Zoom Workplace Apps)
- [CVE-2024-45425](https://cve.now/CVE-2024-45425.md): Zoom Workplace Apps - Incorrect User Management (CVSS 4.9, Zoom Communications Zoom Workplace Apps)
- [CVE-2024-45424](https://cve.now/CVE-2024-45424.md): Zoom Workplace Apps - Business Logic Error (CVSS 5.3, Zoom Communications Zoom Workplace Apps)
- [CVE-2024-36259](https://cve.now/CVE-2024-36259.md): Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sens (CVSS 7.5, Odoo Community · Odoo Enterprise)
- [CVE-2025-27135](https://cve.now/CVE-2025-27135.md): RAGFlow SQL Injection vulnerability (CVSS 8.9, infiniflow ragflow)
- [CVE-2024-12368](https://cve.now/CVE-2024-12368.md): Improper access control in the auth\_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth (CVSS 8.1, Odoo Community · Odoo Enterprise)
- [CVE-2025-25192](https://cve.now/CVE-2025-25192.md): GLPI allows unauthorized access to debug mode (CVSS 6.5, glpi-project glpi)
- [CVE-2025-23046](https://cve.now/CVE-2025-23046.md): GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin (CVSS 6.3, glpi-project glpi)
- [CVE-2025-1204](https://cve.now/CVE-2025-1204.md): The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, bypassing existing (CVSS 7.7, Contec Health CMS8000 Patient Monitor)
- [CVE-2025-1068](https://cve.now/CVE-2025-1068.md): There is a code injection vulnerability in Esri ArcGIS AllSource (CVSS 7.3, Esri ArcGIS AllSource)
- [CVE-2025-1067](https://cve.now/CVE-2025-1067.md): There is a code injection vulnerability in ArcGIS Pro (CVSS 7.3, Esri ArcGIS Pro)
- [CVE-2025-26601](https://cve.now/CVE-2025-26601.md): Xorg: xwayland: use-after-free in syncinittrigger() (CVSS 7.8, xserver · Red Hat Enterprise Linux)
- [CVE-2025-26600](https://cve.now/CVE-2025-26600.md): Xorg: xwayland: use-after-free in playreleasedevents() (CVSS 7.8, xserver · Red Hat Enterprise Linux)
- [CVE-2025-26599](https://cve.now/CVE-2025-26599.md): Xorg: xwayland: use of uninitialized pointer in compredirectwindow() (CVSS 7.8, xserver · Red Hat Enterprise Linux)
- [CVE-2025-26598](https://cve.now/CVE-2025-26598.md): Xorg: xwayland: out-of-bounds write in createpointerbarrierclient() (CVSS 7.8, xserver · Red Hat Enterprise Linux)
- [CVE-2025-26597](https://cve.now/CVE-2025-26597.md): Xorg: xwayland: buffer overflow in xkbchangetypesofkey() (CVSS 7.8, xserver · Red Hat Enterprise Linux)
- [CVE-2025-26596](https://cve.now/CVE-2025-26596.md): Xorg: xwayland: heap overflow in xkbwritekeysyms() (CVSS 7.8, xserver · Red Hat Enterprise Linux)
- [CVE-2025-26595](https://cve.now/CVE-2025-26595.md): Xorg: xwayland: buffer overflow in xkbvmodmasktext() (CVSS 7.8, xserver · Red Hat Enterprise Linux)
- [CVE-2025-26594](https://cve.now/CVE-2025-26594.md): X.org: xwayland: use-after-free of the root cursor (CVSS 7.8, xserver · Red Hat Enterprise Linux)
- [CVE-2025-23024](https://cve.now/CVE-2025-23024.md): GLPI: Plugins are disabled accessing one page (CVSS 6.9, glpi-project glpi)
- [CVE-2025-21627](https://cve.now/CVE-2025-21627.md): GLPI Cross-site Scripting vulnerability (CVSS 6.5, glpi-project glpi)
- [CVE-2025-21626](https://cve.now/CVE-2025-21626.md): GLPI vulnerable to exposure of sensitive information in the \`status.php\` endpoint (CVSS 5.8, glpi-project glpi)
- [CVE-2024-11955](https://cve.now/CVE-2024-11955.md): GLPI index.php redirect (CVSS 5.3, GLPI)
- [CVE-2023-25574](https://cve.now/CVE-2023-25574.md): JupyterHub's LTI13Authenticator: JWT signature not validated (CVSS 10.0, jupyterhub ltiauthenticator · jupyterhub-ltiauthenticator)
- [CVE-2025-26995](https://cve.now/CVE-2025-26995.md): WordPress Market Exporter plugin \<= 2.0.21 - Broken Access Control vulnerability (CVSS 5.4, Anton Vanyukov Market Exporter)
- [CVE-2025-26993](https://cve.now/CVE-2025-26993.md): WordPress Visual Website Collaboration Atarim plugin \<= 4.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Vito Peleg Atarim)
- [CVE-2025-26991](https://cve.now/CVE-2025-26991.md): WordPress WPPizza plugin \<= 3.19.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ollybach WPPizza)
- [CVE-2025-26983](https://cve.now/CVE-2025-26983.md): WordPress Recipe Card Blocks for Gutenberg & Elementor plugin \<= 3.4.3 - Broken Access Control vulnerability (CVSS 4.3, WPZOOM Recipe Card Blocks for Gutenberg & Elementor)
- [CVE-2025-26981](https://cve.now/CVE-2025-26981.md): WordPress Web Accessibility By accessiBe plugin \<= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Web Accessibility By accessiBe)
- [CVE-2025-26980](https://cve.now/CVE-2025-26980.md): WordPress Wired Impact Volunteer Management plugin \<= 2.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Wired Impact Volunteer Management)
- [CVE-2025-26979](https://cve.now/CVE-2025-26979.md): WordPress Funnel Builder by FunnelKit plugin \<= 3.9.0 - Local File Inclusion vulnerability (CVSS 7.5, Aman Funnel Builder by FunnelKit)
- [CVE-2025-26977](https://cve.now/CVE-2025-26977.md): WordPress FileBird plugin \<= 6.4.2.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 3.8, Ninja Team Filebird)
- [CVE-2025-26975](https://cve.now/CVE-2025-26975.md): WordPress Strong Testimonials plugin \<= 3.2.3 - Broken Access Control vulnerability (CVSS 5.3, WP Chill Strong Testimonials)
- [CVE-2025-26974](https://cve.now/CVE-2025-26974.md): WordPress WP Multi Store Locator plugin \<= 2.5.1 - SQL Injection vulnerability (CVSS 9.3, WPExperts.io WP Multistore Locator)
- [CVE-2025-26971](https://cve.now/CVE-2025-26971.md): WordPress Poll Maker \<= 5.6.5 - SQL Injection vulnerability (CVSS 7.6, Ays Pro Poll Maker)
- [CVE-2025-26966](https://cve.now/CVE-2025-26966.md): WordPress PrivateContent plugin \<= 8.11.5 - Unauthenticated Account Takeover vulnerability (CVSS 9.8, Aldo Latino PrivateContent)
- [CVE-2025-26965](https://cve.now/CVE-2025-26965.md): WordPress Amelia plugin \<= 1.2.16 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, ameliabooking Amelia)
- [CVE-2025-26964](https://cve.now/CVE-2025-26964.md): WordPress Eventin plugin \<= 4.0.20 - Local File Inclusion vulnerability (CVSS 7.5, Arraytics Eventin)
- [CVE-2025-26963](https://cve.now/CVE-2025-26963.md): WordPress ClickWhale plugin \<= 2.4.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 5.4, ClickWhale)
- [CVE-2025-26962](https://cve.now/CVE-2025-26962.md): WordPress Contact Form Plugin plugin \<= 1.1.25 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GhozyLab Easy Contact Form Lite)
- [CVE-2025-26960](https://cve.now/CVE-2025-26960.md): WordPress Small Package Quotes – Unishippers Edition plugin \<= 2.4.9 - Broken Access Control vulnerability (CVSS 6.5, enituretechnology Small Package Quotes – Unishippers Edition)
- [CVE-2025-26957](https://cve.now/CVE-2025-26957.md): WordPress Affiliate Coupons plugin \<= 1.7.3 - Local File Inclusion vulnerability (CVSS 7.5, Deetronix Affiliate Coupons)
- [CVE-2025-26952](https://cve.now/CVE-2025-26952.md): WordPress Business Card Block plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Business Card Block)
- [CVE-2025-26949](https://cve.now/CVE-2025-26949.md): WordPress Team Section Block plugin \<= 1.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Team Section Block)
- [CVE-2025-26948](https://cve.now/CVE-2025-26948.md): WordPress Pie Register Premium plugin \<= 3.8.3.2 - Broken Access Control vulnerability (CVSS 4.3, NotFound Pie Register Premium)
- [CVE-2025-26947](https://cve.now/CVE-2025-26947.md): WordPress Services Section block plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Services Section block)
- [CVE-2025-26946](https://cve.now/CVE-2025-26946.md): WordPress WP Yelp Review Slider Plugin \<= 8.1 - SQL Injection vulnerability (CVSS 7.6, jgwhite33 WP Yelp Review Slider)
- [CVE-2025-26945](https://cve.now/CVE-2025-26945.md): WordPress Info Cards plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Info Cards)
- [CVE-2025-26943](https://cve.now/CVE-2025-26943.md): WordPress Easy Quotes plugin \<= 1.2.2 - SQL Injection vulnerability (CVSS 9.3, Jürgen Müller Easy Quotes)
- [CVE-2025-26939](https://cve.now/CVE-2025-26939.md): WordPress Counters Block plugin \<= 1.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Counters Block)
- [CVE-2025-26938](https://cve.now/CVE-2025-26938.md): WordPress Countdown Timer block plugin \<= 1.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Countdown Timer)
- [CVE-2025-26937](https://cve.now/CVE-2025-26937.md): WordPress Icon List Block plugin \<= 1.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Icon List Block)
- [CVE-2025-26935](https://cve.now/CVE-2025-26935.md): WordPress WP Job Portal plugin \<= 2.2.8 - Local File Inclusion vulnerability (CVSS 7.5, wpjobportal WP Job Portal)
- [CVE-2025-26932](https://cve.now/CVE-2025-26932.md): WordPress WPBot plugin \<= 6.3.5 - Local File Inclusion vulnerability (CVSS 7.5, QuantumCloud ChatBot)
- [CVE-2025-26931](https://cve.now/CVE-2025-26931.md): WordPress Tribulant Gallery Voting plugin \<= 1.2.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Tribulant Software Tribulant Gallery Voting)
- [CVE-2025-26928](https://cve.now/CVE-2025-26928.md): WordPress Order Limit for WooCommerce plugin \<= 3.0.2 - Broken Access Control vulnerability (CVSS 4.3, Xfinitysoft Order Limit for WooCommerce)
- [CVE-2025-26926](https://cve.now/CVE-2025-26926.md): WordPress Booknetic plugin \< 5.10.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Booknetic)
- [CVE-2025-26915](https://cve.now/CVE-2025-26915.md): WordPress Wishlist Plugin \<= 1.0.41 - SQL Injection vulnerability (CVSS 8.5, PickPlugins Wishlist)
- [CVE-2025-26913](https://cve.now/CVE-2025-26913.md): WordPress AR for WordPress plugin \<= 7.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webandprint AR For WordPress)
- [CVE-2025-26912](https://cve.now/CVE-2025-26912.md): WordPress Easy Elementor Addons plugin \<= 2.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, hashthemes Easy Elementor Addons)
- [CVE-2025-26911](https://cve.now/CVE-2025-26911.md): WordPress System Dashboard plugin \<= 2.8.18 - Sensitive Data Exposure vulnerability (CVSS 4.3, Bowo System Dashboard)
- [CVE-2025-26907](https://cve.now/CVE-2025-26907.md): WordPress Estatik Mortgage Calculator plugin \<= 2.0.12 - Local File Inclusion vulnerability (CVSS 7.5, Mortgage Calculator Estatik)
- [CVE-2025-26905](https://cve.now/CVE-2025-26905.md): WordPress Estatik plugin \<= 4.3.0 - Local File Inclusion vulnerability (CVSS 7.5, Estatik)
- [CVE-2025-26904](https://cve.now/CVE-2025-26904.md): WordPress WP Responsive Auto Fit Text plugin \<= 0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, gal\_op WP Responsive Auto Fit Text)
- [CVE-2025-26900](https://cve.now/CVE-2025-26900.md): WordPress Flexmls® IDX Plugin Plugin \<= 3.14.27 - PHP Object Injection vulnerability (CVSS 9.8, Flexmls® IDX)
- [CVE-2025-26897](https://cve.now/CVE-2025-26897.md): WordPress List Related Attachments plugin \<= 2.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Baden List Related Attachments)
- [CVE-2025-26896](https://cve.now/CVE-2025-26896.md): WordPress PiwigoPress plugin \<= 2.33 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, vpiwigo PiwigoPress)
- [CVE-2025-26893](https://cve.now/CVE-2025-26893.md): WordPress Easy Charts plugin \<= 1.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kiran Potphode Easy Charts)
- [CVE-2025-26891](https://cve.now/CVE-2025-26891.md): WordPress Ibtana plugin \<= 1.2.5.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, VW THEMES Ibtana)
- [CVE-2025-26887](https://cve.now/CVE-2025-26887.md): WordPress EZ SQL Reports Shortcode Widget and DB Backup plugin \<= 5.21.35 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Eli EZ SQL Reports Shortcode Widget and DB Backup)
- [CVE-2025-26884](https://cve.now/CVE-2025-26884.md): WordPress Greenshift plugin \<= 10.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpsoul Greenshift)
- [CVE-2025-26882](https://cve.now/CVE-2025-26882.md): WordPress Popup Builder plugin \<= 1.1.33 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GhozyLab Popup Builder)
- [CVE-2025-26881](https://cve.now/CVE-2025-26881.md): WordPress Sticky Content plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Sticky Content)
- [CVE-2025-26878](https://cve.now/CVE-2025-26878.md): WordPress Autoship Cloud for WooCommerce Subscription Products plugin \<= 2.8.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, patternsinthecloud Autoship Cloud for WooCommerce Subscript…)
- [CVE-2025-26877](https://cve.now/CVE-2025-26877.md): WordPress Front End Users Plugin \<= 3.2.30 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rustaurius Front End Users)
- [CVE-2025-26876](https://cve.now/CVE-2025-26876.md): WordPress Search with Typesense Plugin \<= 2.0.8 - Path Traversal vulnerability (CVSS 6.8, CodeManas Search with Typesense)
- [CVE-2025-26871](https://cve.now/CVE-2025-26871.md): WordPress Essential Blocks plugin \<= 4.8.3 - Broken Access Control vulnerability (CVSS 4.3, WPDeveloper Essential Blocks for Gutenberg)
- [CVE-2025-26868](https://cve.now/CVE-2025-26868.md): WordPress Fast Flow plugin \<= 1.2.16 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fastflow Fast Flow)
- [CVE-2025-26753](https://cve.now/CVE-2025-26753.md): WordPress VideoWhisper Live Streaming Integration plugin \<= 6.2 - Arbitrary File Download vulnerability (CVSS 7.5, videowhisper Broadcast Live Video)
- [CVE-2025-26752](https://cve.now/CVE-2025-26752.md): WordPress VideoWhisper Live Streaming Integration plugin \<= 6.2 - Arbitrary File Deletion vulnerability (CVSS 8.6, videowhisper Broadcast Live Video)
- [CVE-2025-26751](https://cve.now/CVE-2025-26751.md): WordPress Alphabetic Pagination Plugin \<= 3.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Fahad Mahmood Alphabetic Pagination)
- [CVE-2024-54444](https://cve.now/CVE-2024-54444.md): WordPress Elementor plugin \<= 3.25.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Elementor Website Builder)
- [CVE-2025-27000](https://cve.now/CVE-2025-27000.md): WordPress Simple Photo Feed Plugin \<= 1.4.0 - Broken Access Control vulnerability (CVSS 5.4, George Pattichis Simple Photo Feed)
- [CVE-2025-26987](https://cve.now/CVE-2025-26987.md): WordPress Frontend Admin by DynamiApps plugin \<= 3.25.17 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Shabti Kaplan Frontend Admin by DynamiApps)
- [CVE-2025-26985](https://cve.now/CVE-2025-26985.md): WordPress Majestic Support plugin \<= 1.0.6 - Local File Inclusion vulnerability (CVSS 8.1, Majestic Support)
- [CVE-2024-51539](https://cve.now/CVE-2024-51539.md): The Dell Secure Connect Gateway (SCG) Application and Appliance, versions prior to 5.28, contains a SQL injection vulnerability due to impro (CVSS 2.3, Dell Secure Connect Gateway - Application · Dell Secure Con…)
- [CVE-2025-1262](https://cve.now/CVE-2025-1262.md): Advanced Google reCaptcha \<= 1.27 - Built-in Math CAPTCHA Bypass (CVSS 5.3, webfactory Advanced Google reCAPTCHA)
- [CVE-2025-1676](https://cve.now/CVE-2025-1676.md): hzmanyun Education and Training System pdf2swf os command injection (CVSS 5.3, hzmanyun Education and Training System)
- [CVE-2024-13695](https://cve.now/CVE-2024-13695.md): Enfold \<= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment\_id (CVSS 6.4, Kriesi Enfold - Responsive Multi-Purpose Theme)
- [CVE-2024-13693](https://cve.now/CVE-2024-13693.md): Enfold \<= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php (CVSS 5.3, Kriesi Enfold - Responsive Multi-Purpose Theme)
- [CVE-2024-13494](https://cve.now/CVE-2024-13494.md): WordPress File Upload \<= 4.25.2 - Cross-Site Request Forgery in wfu\_file\_details (CVSS 4.3, nickboss Iptanus File Upload)
- [CVE-2025-1675](https://cve.now/CVE-2025-1675.md): Out of bounds read in dns\_copy\_qname (CVSS 8.2, zephyrproject-rtos Zephyr)
- [CVE-2025-1674](https://cve.now/CVE-2025-1674.md): Out of bounds read when unpacking DNS answers (CVSS 8.2, zephyrproject-rtos Zephyr)
- [CVE-2025-1673](https://cve.now/CVE-2025-1673.md): Out of bounds read when calling crc16\_ansi and strlen in dns\_validate\_msg (CVSS 8.2, zephyrproject-rtos Zephyr)
- [CVE-2025-1063](https://cve.now/CVE-2025-1063.md): Classified Listing – Classified ads & Business Directory Plugin \<= 4.0.4 - Unauthenticated Settings Exposure (CVSS 5.3, techlabpro1 Classified Listing – AI-Powered Classified ads…)
- [CVE-2025-1128](https://cve.now/CVE-2025-1128.md): Everest Forms \<= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion (CVSS 9.8, wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…)
- [CVE-2025-1648](https://cve.now/CVE-2025-1648.md): Yawave \<= 2.9.1 - Unauthenticated SQL Injection (CVSS 7.5, yawaveadmin Yawave)
- [CVE-2024-10545](https://cve.now/CVE-2024-10545.md): NextGEN Gallery \< 3.59.9 - Admin+ Stored XSS (CVSS 3.5, Photo Gallery, Sliders, Proofing and Themes)
- [CVE-2025-22210](https://cve.now/CVE-2025-22210.md): Extension - hikashop.com - SQL injection in Hikashop component version 3.3.0 - 5.1.4 for Joomla (CVSS 7.2, hikashop.com Hikashop component for Joomla)
- [CVE-2025-1646](https://cve.now/CVE-2025-1646.md): Lumsoft ERP ASPX File UploadAjaxAPI.ashx unrestricted upload (CVSS 6.9, Lumsoft ERP)
- [CVE-2025-1645](https://cve.now/CVE-2025-1645.md): Benner Connecta EditarLogado resource injection (CVSS 5.3, Benner Connecta)
- [CVE-2025-27145](https://cve.now/CVE-2025-27145.md): copyparty renders unsanitized filenames as HTML when user uploads empty files (CVSS 3.6, 9001 copyparty · copyparty)
- [CVE-2025-1644](https://cve.now/CVE-2025-1644.md): Benner ModernaNet SG\_Gravar cross-site request forgery (CVSS 5.3, Benner ModernaNet)
- [CVE-2025-1643](https://cve.now/CVE-2025-1643.md): Benner ModernaNet SG\_AlterarSenha cross-site request forgery (CVSS 5.3, Benner ModernaNet)
- [CVE-2025-1642](https://cve.now/CVE-2025-1642.md): Benner ModernaNet GetImageMedico resource injection (CVSS 5.3, Benner ModernaNet)
- [CVE-2025-1641](https://cve.now/CVE-2025-1641.md): Benner ModernaNet GetHorariosDoDia sql injection (CVSS 6.9, Benner ModernaNet)
- [CVE-2025-1640](https://cve.now/CVE-2025-1640.md): Benner ModernaNet JS\_CarregaCombo sql injection (CVSS 6.9, Benner ModernaNet)
- [CVE-2024-34034](https://cve.now/CVE-2024-34034.md): An issue was discovered in FlexRIC 2.0.0. (CVSS 5.7)
- [CVE-2024-34035](https://cve.now/CVE-2024-34035.md): An issue was discovered in O-RAN Near Realtime RIC H-Release. (CVSS 5.7)
- [CVE-2024-34036](https://cve.now/CVE-2024-34036.md): An issue was discovered in O-RAN Near Realtime RIC I-Release. (CVSS 4.3)
- [CVE-2025-25514](https://cve.now/CVE-2025-25514.md): Seacms \<=13.3 is vulnerable to SQL Injection in admin\_collect\_news.php. (CVSS 6.5)
- [CVE-2025-25515](https://cve.now/CVE-2025-25515.md): Seacms \<=13.3 is vulnerable to SQL Injection in admin\_collect.php that allows an authenticated attacker to exploit the database. (CVSS 8.8)
- [CVE-2025-25516](https://cve.now/CVE-2025-25516.md): Seacms \<=13.3 is vulnerable to SQL Injection in admin\_paylog.php. (CVSS 9.8)
- [CVE-2025-25517](https://cve.now/CVE-2025-25517.md): Seacms \<=13.3 is vulnerable to SQL Injection in admin\_reslib.php. (CVSS 9.8)
- [CVE-2025-25519](https://cve.now/CVE-2025-25519.md): Seacms \<=13.3 is vulnerable to SQL Injection in admin\_zyk.php. (CVSS 9.8)
- [CVE-2025-25520](https://cve.now/CVE-2025-25520.md): Seacms \<13.3 is vulnerable to SQL Injection in admin\_pay.php. (CVSS 9.8)
- [CVE-2025-25521](https://cve.now/CVE-2025-25521.md): Seacms \<=13.3 is vulnerable to SQL Injection in admin\_type\_news.php. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.