CVEs published February 28, 2025
85 CVEs were published on February 28, 2025: 7 critical, 18 high.
- Published
- 85
- Critical
- 7
- High
- 18
- Medium
- 56
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- CyberArk Endpoint Privilege Manager
- 5
- IBM MQ
- 5
- Dario Health USB-C Blood Glucose Monitoring System Starter…
- 4
- OpenCart
- 4
- Dario Health Dario Application Database and Internet-based…
- 3
- Eaton Foreseer Reporting Software
- 2
- IBM Cognos Analytics
- 2
- IBM Storage Virtualize
- 2
- pwndoc
- 2
- apprhyme URL Media Uploader
- 1
Critical 7
- CVE-2025-0159IBM FlashSystem authentication bypassIBM Storage Virtualize
- CVE-2025-22273Lack of rate-limiting in password change mechanism in CyberArk Endpoint Privilege ManagerCyberArk Endpoint Privilege Manager
- CVE-2024-8420DHVC Form <= 2.4.7 - Unauthenticated Privilege EscalationSiteSao DHVC Form
- CVE-2024-8425WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File UploadWP Swings WooCommerce Ultimate Gift Card
- CVE-2024-9193WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Updatecreativeon WHMpress - WHMCS WordPress Integration Plugin
- CVE-2025-1744Out-of-bounds Write in radare2radareorg radare2
- CVE-2025-25379Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the
High 18
- CVE-2024-1509Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100Brocade ASCG
- CVE-2025-0160IBM FlashSystem code executionIBM Storage Virtualize
- CVE-2025-24849Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cleartext Transmission of Sensitive InformationDario Health USB-C Blood Glucose Monitoring System Starter…
- CVE-2025-20060Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Exposure of Private Personal Information to an Unauthorized ActorDario Health USB-C Blood Glucose Monitoring System Starter…
- CVE-2025-1319Site Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site Scriptingelemntor Site Mailer – SMTP Replacement, Email API Delivera…
- CVE-2025-22270Stored XSS in CyberArk Endpoint Privilege ManagerCyberArk Endpoint Privilege Manager
- CVE-2025-1413Dylib Hijacking in DaVinci ResolveBlackmagic Design DaVinci Resolve
- CVE-2024-9195WHMPress - WHMCS Client Area <= 4.3-revision-3- Authenticated (Subscriber+) Arbitrary Options Updatecreativeon WHMCS Client Area for WordPress by WHMpress
- CVE-2025-1570Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTPwpwax Directorist: AI-Powered Business Directory, Listings…
- CVE-2024-13831Tabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabswpbranch Tabs for WooCommerce
- CVE-2025-1513Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site Scriptingcontest-gallery Contest Gallery – Upload & Vote Photos, Med…
- CVE-2025-0975IBM MQ code executionIBM MQ
- CVE-2025-25428TRENDnet TEW-929DRU 1.0.0.10 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in a
- CVE-2025-25609TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability.
- CVE-2025-25610TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability.
- CVE-2025-25635TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability.
- CVE-2025-25723Buffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code.
- CVE-2025-26326A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which a
Medium, low and unrated 60
- CVE-2025-26466Openssh: denial-of-service in opensshOpenSSH · Red Hat Enterprise Linux +1
- CVE-2025-27414MinIO SFTP authentication bypass due to improperly trusted SSH keyminio · github.com/minio/minio
- CVE-2025-27413PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.jsonpwndoc
- CVE-2025-27410PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as adminpwndoc
- CVE-2025-0769PixelYourSite 10.1.1.1 - Insecure deserializationpixelyoursite
- CVE-2025-1795Mishandling of comma during folding and unicode-encoding of email headersPython Software Foundation CPython
- CVE-2025-27408Manifest Uses a One-Way Hash without a Saltmnfst manifest · manifest
- CVE-2025-24316Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Exposure of Sensitive Information Due to Incompatible PoliciesDario Health Dario Application Database and Internet-based…
- CVE-2025-24318Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' FlagDario Health Dario Application Database and Internet-based…
- CVE-2025-20049Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cross-site ScriptingDario Health Dario Application Database and Internet-based…
- CVE-2025-24843Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Storage of Sensitive Data in a Mechanism without Access ControlDario Health USB-C Blood Glucose Monitoring System Starter…
- CVE-2025-23405Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Improper Output Neutralization For LogsDario Health USB-C Blood Glucose Monitoring System Starter…
- CVE-2025-0985IBM MQ information disclosureIBM MQ
- CVE-2024-54175IBM MQ denial of serviceIBM MQ
- CVE-2025-27400Magento vulnerable to stored XSS in theme config fieldsOpenMage magento-lts · openmage/magento-lts
- CVE-2025-1776Cross-Site Scripting (XSS) vulnerability in SoteshopSoteshop
- CVE-2025-1749HTML injection vulnerability in OpenCartOpenCart
- CVE-2025-1748HTML injection vulnerability in OpenCartOpenCart
- CVE-2025-1747HTML injection vulnerability in OpenCartOpenCart
- CVE-2025-1746Cross-Site Scripting vulnerability in OpenCartOpenCart
- CVE-2025-1300Open redirect in CodeChecker web serverEricsson CodeChecker · codechecker
- CVE-2025-22274HTML injection in CyberArk Endpoint Privilege ManagerCyberArk Endpoint Privilege Manager
- CVE-2025-22272Self Reflected XSS in CyberArk Endpoint Privilege ManagerCyberArk Endpoint Privilege Manager
- CVE-2025-22271IP Spoofing in CyberArk Endpoint Privilege ManagerCyberArk Endpoint Privilege Manager
- CVE-2024-10860NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submissionxlplugins NextMove Lite – Thank You Page for WooCommerce
- CVE-2025-22492Insecure storage of connection strings in FRSEaton Foreseer Reporting Software
- CVE-2025-22491Improper Input Validation in Foreseer Reporting Software (FRS)Eaton Foreseer Reporting Software
- CVE-2024-13851Modal Portfolio <= 1.7.4.2 - Authenticated (Administrator+) Stored Cross-Site Scriptingevigeo Modal Portfolio
- CVE-2025-1662URL Media Uploader <= 1.0.0 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebindingapprhyme URL Media Uploader
- CVE-2024-13638Order Attachments for WooCommerce <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directorysldesignpl Order Attachments for WooCommerce
- CVE-2024-9019SecuPress Free — WordPress Security <= 2.2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via secupress_check_ban_ips_form ShortcodeSecuPress with Simple SSL – Simple and Performant Security
- CVE-2024-13469Pricing Table by PickPlugins <= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingPickPlugins Pricing Table
- CVE-2024-13716Forex Calculators <= 1.3.7 - Missing Authorization to Authenticated (Subscriber+) Settings Updatetarborali Forex Calculators
- CVE-2024-13832Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosureultrapressorg Ultra Addons Lite for Elementor
- CVE-2025-1560WOW Entrance Effects (WEE!) <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingdarkosxrc WOW Entrance Effects
- CVE-2025-1572KiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameteriqonicdesign KiviCare – Clinic & Patient Management System
- CVE-2025-1571Exclusive Addons for Elementor <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison Widgetstimstrifler Exclusive Addons for Elementor
- CVE-2025-1405Product Catalog Simple <= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_products Shortcodeimplecode Product Catalog Simple
- CVE-2025-0764wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in updatetomdever wpForo Forum
- CVE-2025-1506Wp Social Login and Register Social Counter <= 3.1.0 - Cross-Site Request Forgery to Settings Updateroxnor Wp Social Login and Register Social Counter
- CVE-2024-12820MK Google Directions <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingmanoj_rana91986 MK Google Directions
- CVE-2025-1511User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scriptingwpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2025-0801RateMyAgent Official <= 1.4.0 - Cross-Site Request Forgery to API Key UpdateRateMyAgent Official
- CVE-2025-1505Advanced AJAX Product Filters <= 1.6.8.1 - Reflected Cross-Site Scriptingberocket Advanced AJAX Product Filters
- CVE-2025-1757WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeportfoliohub WordPress Portfolio Builder – Portfolio Gallery
- CVE-2024-13796Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.6 - Unauthenticated User Information Exposurepickplugins Post Grid
- CVE-2024-56340IBM Cognos Analytics path traversalIBM Cognos Analytics
- CVE-2025-0823IBM MQ path traversalIBM Cognos Analytics
- CVE-2025-23225IBM MQ denial of serviceIBM MQ
- CVE-2024-54173IBM MQ information disclosureIBM MQ
- CVE-2024-44754Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate attackers to inject mo
- CVE-2025-25429Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the r_name variable inside the have_same_name fu
- CVE-2025-25430Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the configname parameter on the /cbi_addcert.htm
- CVE-2025-25431Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the The ssid key of wifi_data parameter on the /
- CVE-2025-25461A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29.
- CVE-2025-25476A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Jav
- CVE-2025-25478The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames.
- CVE-2025-25916wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php.
- CVE-2025-26047Loggrove v1.0 is vulnerable to SQL Injection in the read.py file.
- CVE-2025-26263GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure d