Skip to content
OpenAdvisories

Archive

14 February 2025

Vulnerabilities first published on this day (UTC), newest first.

← January 2025 2025 / February /14 March 2025 →
  1. 139
  2. 24
  3. 3187
  4. 4151
  5. 5119
  6. 699
  7. 7120
  8. 87
  9. 94
  10. 1081
  11. 11283
  12. 12265
  13. 13132
  14. 14134
  15. 1524
  16. 1640
  17. 1748
  18. 18162
  19. 19125
  20. 20120
  21. 2192
  22. 2234
  23. 2330
  24. 24119
  25. 25144
  26. 26795
  27. 27275
  28. 2887
All Critical High Medium Low Exploited only Public exploit

73 results · Clear filters · Feed

  • High 8.2
    CVE-2024-4282

    Weak TLS Ciphers on Brocade SANnav OVA SSH port 22

    Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22.

    Brocade Brocade SANnav
  • High 7.5
    CVE-2022-26083

    Generation of weak initialization vector in an Intel(R) IPP Cryptography software library before version 2021.5 may all…

  • High 8.8
    CVE-2025-0593

    SICK Lector8xx and InspectorP8xx vulnerable for code execution

    The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device.

    SICK SICK InspectorP8xx SICK Lector8xx
  • High 8.8
    CVE-2025-0592

    SICK Lector8xx and InspectorP8xx vulnerable for code execution

    The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device.

    SICK SICK Lector8xx SICK InspectorP8xx
  • High 8.6
    CVE-2025-25297

    Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

    Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery (SSRF) vulnerability in its endpoint configuration. When creating an S3 storage connection, the ap…

    HumanSignal label-studio label-studio PyPI
  • High —
    GHSA-5v93-9mqw-p9mh

    Uncaught Panic in ORML Rewards Pallet

    ## Summary A vulnerability in the `add_share` function of the **Rewards** pallet (part of the ORML repository) can lead to an uncaught Rust panic when handling user-provided input exceeding the `u128` range. ## Affected Components - **ORML Rewards** pallet (`…

    orml-rewards crates.io
  • High 8.3
    CVE-2025-26508

    Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers – Potential Remote Code Execution and Potential Elevation of Privilege

    Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.

    HP Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers
  • High 8.7
    CVE-2025-25295

    Label Studio has a Path Traversal Vulnerability via image Field

    Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functiona…

    HumanSignal label-studio label-studio-sdk PyPI
  • High 8.3
    CVE-2025-25206

    Incorrect input validation could allow an authenticated user to read sensitive information

    eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database. This co…

    elabftw elabftw
  • High 7.3
    CVE-2024-8893

    Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proxim…

    GoodWe Technologies GW1500‑XS
  • High 8.5
    CVE-2024-12651

    Sensitive Data Exposure in PTT Inc.'s HGS Mobile App

    Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0.

    PTT HGS Mobile App
  • High 7.2
    CVE-2024-52500

    WordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Monetag Official Plugin: from n/a through <= 1.1.3.

    monetagwp Monetag Official Plugin
  • High 7.1
    CVE-2025-23905

    WordPress Admin Options Pages plugin <= 0.9.7 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johannes van Poelgeest Admin Options Pages admin-options-pages allows Reflected XSS.This issue affects Admin Options Pages: from n/a through <= 0.9.7.

    Johannes van Poelgeest Admin Options Pages
  • High 7.1
    CVE-2025-22705

    WordPress Disqus Popular Posts plugin <= 2.1.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in godthor Disqus Popular Posts disqus-popular-posts allows Reflected XSS.This issue affects Disqus Popular Posts: from n/a through <= 2.1.1.

    godthor Disqus Popular Posts
  • High 7.1
    CVE-2025-24692

    WordPress Bulk Menu Edit plugin <= 1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in M.Code Bulk Menu Edit bulk-menu-edit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Menu Edit: from n/a through <= 1.3.

    M.Code Bulk Menu Edit
  • High 7.1
    CVE-2025-24688

    WordPress WP Mailster Plugin <= 1.8.20.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through <= 1.8.20.0.

    Brandtoss WP Mailster
  • High 7.1
    CVE-2025-24617

    WordPress AcyMailing Plugin < 9.11.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through < 9.11.…

    AcyMailing Newsletter Team AcyMailing SMTP Newsletter
  • High 7.1
    CVE-2025-24641

    WordPress Better WishList API plugin <= 1.1.3 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rickonline_nl Better WishList API better-wlm-api allows Stored XSS.This issue affects Better WishList API: from n/a through <= 1.1.3.

    rickonline_nl Better WishList API
  • High 7.1
    CVE-2025-24616

    WordPress Uix Page Builder Plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UIUX Lab Uix Page Builder uix-page-builder allows Reflected XSS.This issue affects Uix Page Builder: from n/a through <= 1.7.3.

    UIUX Lab Uix Page Builder
  • High 7.1
    CVE-2025-24615

    WordPress Analytics Cat Plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Analytics Cat analytics-cat allows Reflected XSS.This issue affects Analytics Cat: from n/a through <= 1.1.2.

    Fatcat Apps Analytics Cat
  • High 7.1
    CVE-2025-24700

    WordPress WP Event Aggregator Plugin <= 1.8.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator wp-event-aggregator allows Reflected XSS.This issue affects WP Event Aggregator: from n/a through <= 1.8.2.

    Xylus Themes WP Event Aggregator
  • High 7.1
    CVE-2025-24699

    WordPress WP Coder Plugin <= 3.6 - CSRF to Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company WP Coder wp-coder allows Cross-Site Scripting (XSS).This issue affects WP Coder: from n/a through <= 3.6.

    Wow-Company WP Coder
  • High 7.1
    CVE-2025-24565

    WordPress WP2LEADS plugin <= 3.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.3.3.

    Saleswonder Team: Tobias WP2LEADS
  • High 7.1
    CVE-2025-24566

    WordPress Intro Tour Tutorial DeepPresentation plugin <= 6.5.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomáš Groulík Intro Tour Tutorial DeepPresentation dp-intro-tours allows Reflected XSS.This issue affects Intro Tour Tutorial DeepPresentation: from n/a thro…

    Tomáš Groulík Intro Tour Tutorial DeepPresentation
  • High 7.1
    CVE-2025-24592

    WordPress SysBasics Customize My Account for WooCommerce plugin <= 2.8.22 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SysBasics Customize My Account for WooCommerce customize-my-account-for-woocommerce allows Reflected XSS.This issue affects Customize My Account for WooComme…

    SysBasics Customize My Account for WooCommerce Web / CMS
  • High 7.1
    CVE-2025-24614

    WordPress Post Timeline Plugin <= 2.3.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agile Logix Post Timeline post-timeline allows Reflected XSS.This issue affects Post Timeline: from n/a through <= 2.3.9.

    Agile Logix Post Timeline
  • High 7.1
    CVE-2025-24564

    WordPress Contact Form With Shortcode plugin <= 4.2.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Contact Form With Shortcode contact-form-with-shortcode allows Reflected XSS.This issue affects Contact Form With Shortcode: from n/a through …

    aviplugins.com Contact Form With Shortcode
  • High 7.1
    CVE-2025-24554

    WordPress AWcode Toolkit plugin <= 1.0.14 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode AWcode Toolkit awcode-toolkit allows Reflected XSS.This issue affects AWcode Toolkit: from n/a through <= 1.0.14.

    awcode AWcode Toolkit
  • High 7.1
    CVE-2025-24558

    WordPress CRM Perks plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This issue affects CRM Perks: from n/a through <= 1.1.5.

    CRM Perks CRM Perks
  • High 7.1
    CVE-2025-23790

    WordPress Easy Code Placement Plugin <= 18.11 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wassereimer Easy Code Placement allows Reflected XSS. This issue affects Easy Code Placement: from n/a through 18.11.

    wassereimer Easy Code Placement
  • High 7.1
    CVE-2025-23857

    WordPress Essential WP Real Estate Plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SmartDataSoft Essential WP Real Estate essential-wp-real-estate allows Reflected XSS.This issue affects Essential WP Real Estate: from n/a through <= 1.1.3.

    SmartDataSoft Essential WP Real Estate
  • High 7.1
    CVE-2025-23851

    WordPress Coronavirus (COVID-19) Outbreak Data Widgets Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Khushwant Singh Coronavirus (COVID-19) Outbreak Data Widgets coronavirus-data-widgets allows Reflected XSS.This issue affects Coronavirus (COVID-19) Outbreak…

    Khushwant Singh Coronavirus (COVID-19) Outbreak Data Widgets
  • High 7.1
    CVE-2025-23853

    WordPress NoFollow Free plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in michelem NoFollow Free nofollow-free allows Reflected XSS.This issue affects NoFollow Free: from n/a through <= 1.6.3.

    michelem NoFollow Free
  • High 7.1
    CVE-2025-23787

    WordPress Easy Bet Plugin <= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foxskav Easy Bet easy-bet allows Reflected XSS.This issue affects Easy Bet: from n/a through <= 1.0.7.

    Foxskav Easy Bet
  • High 7.1
    CVE-2025-23786

    WordPress Email to Download Plugin <= 3.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Email to Download email-to-download allows Reflected XSS.This issue affects Email to Download: from n/a through <= 3.1.0.

    DuoGeek Email to Download
  • High 7.1
    CVE-2025-23789

    WordPress URL Shortener WooCommerce Plugin <= 9.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking | AB Testing | WooCommerce easy-broken-link-checker allows Reflected XSS.This issue affects URL Shortener |…

    tahminajannat URL Shortener | Conversion Tracking | AB Testing | WooCommerce Web / CMS
  • High 7.1
    CVE-2025-23788

    WordPress Easy Filter Plugin <= 1.10 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roni Saha Easy Filter easy-filter allows Reflected XSS.This issue affects Easy Filter: from n/a through <= 1.10.

    Roni Saha Easy Filter
  • High 7.1
    CVE-2025-23742

    WordPress Podamibe Twilio Private Call plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podamibe Nepal Podamibe Twilio Private Call podamibe-twilio-private-call allows Reflected XSS.This issue affects Podamibe Twilio Private Call: from n/a throu…

    Podamibe Nepal Podamibe Twilio Private Call
  • High 7.1
    CVE-2025-23751

    WordPress Data Dash plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Data Dash data-dash allows Reflected XSS.This issue affects Data Dash: from n/a through <= 1.2.3.

    Think201 Data Dash
  • High 7.1
    CVE-2025-23658

    WordPress Advanced Angular Contact Form plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tauhidul Alam Advanced Angular Contact Form advanced-angular-contact-form allows Reflected XSS.This issue affects Advanced Angular Contact Form: from n/a thr…

    Tauhidul Alam Advanced Angular Contact Form