Skip to content
OpenAdvisories

Archive

8 February 2025

Vulnerabilities first published on this day (UTC), newest first.

← January 2025 2025 / February /8 March 2025 →
  1. 139
  2. 24
  3. 3187
  4. 4151
  5. 5119
  6. 699
  7. 7120
  8. 87
  9. 94
  10. 1081
  11. 11283
  12. 12265
  13. 13132
  14. 14134
  15. 1524
  16. 1640
  17. 1748
  18. 18162
  19. 19125
  20. 20120
  21. 2192
  22. 2234
  23. 2330
  24. 24119
  25. 25144
  26. 26795
  27. 27275
  28. 2887
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 6.4
    CVE-2025-0169

    DWT - Directory & Listing WordPress Theme <=3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo…

    scriptsbundle DWT - Directory & Listing WordPress Theme Web / CMS
  • Critical 9.8
    CVE-2025-0316 Public exploit

    WP Directorybox Manager <= 2.5 - Authentication Bypass

    The WP Directorybox Manager plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_enquiry_agent_contact_form_submit_callback' function. This makes it possible f…

    Chimpstudio WP Directorybox Manager Web / CMS
  • Medium 4.3
    CVE-2024-54176

    IBM UrbanCode Deploy missing authentication

    IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 and IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14 and 7.3 through 7.3.2 could allow an authenticated user to obtain sensitive information about other user…

    IBM UrbanCode Deploy DevOps Deploy
  • High 7.3
    CVE-2025-1117

    CoinRemitter sql injection

    A vulnerability, which was classified as critical, was found in CoinRemitter 0.0.1/0.0.2 on OpenCart. This affects an unknown part. The manipulation of the argument coin leads to sql injection. It is possible to initiate the attack remotely. The exploit has b…

  • Medium 5.5
    CVE-2024-13850

    Simple add pages or posts <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

    The Simple add pages or posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with ad…

    ramon fincken Simple add pages or posts Web / CMS
  • High 7.3
    CVE-2025-1116

    Dreamvention Live AJAX Search Free live_search.searchresults search sql injection

    A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the function searchresults/search of the file /?route=extension/live_search/module/live_search.searchres…

    Dreamvention Live AJAX Search Free
  • Low 3.3
    CVE-2025-1115

    RT-Thread lwp_syscall.c sys_timer_settime information disclosure

    A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sys_device_close/sys_device_control/sys_device_find/sys_device_init/sys_device_open/sys_device_read/sys_device_register/sys_device_wri…