Skip to content
OpenAdvisories

Archive

17 February 2025

Vulnerabilities first published on this day (UTC), newest first.

← January 2025 2025 / February /17 March 2025 →
  1. 139
  2. 24
  3. 3187
  4. 4151
  5. 5119
  6. 699
  7. 7120
  8. 87
  9. 94
  10. 1081
  11. 11283
  12. 12265
  13. 13132
  14. 14134
  15. 1524
  16. 1640
  17. 1748
  18. 18162
  19. 19125
  20. 20120
  21. 2192
  22. 2234
  23. 2330
  24. 24119
  25. 25144
  26. 26795
  27. 27275
  28. 2887
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.2
    CVE-2025-20075

    Server-side request forgery (SSRF) vulnerability exists in FileMegane versions above 3.0.0.0 prior to 3.4.0.0. Executin…

    JIP InfoBridge FileMegane
  • High 7.8
    CVE-2025-21103

    Dell NetWorker Management Console, version(s) 19.11 through 19.11.0.3 & Versions prior to 19.10.0.7 contain(s) an impro…

    Dell NetWorker Management Console
  • High 7.1
    CVE-2025-23845

    WordPress ImageMeta Plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 ImageMeta imagemeta allows Reflected XSS.This issue affects ImageMeta: from n/a through <= 1.1.2.

    ERA404 ImageMeta
  • High 7.1
    CVE-2025-23840

    WordPress WP-NOTCAPTCHA Plugin <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webjema WP-NOTCAPTCHA wp-notcaptcha allows Reflected XSS.This issue affects WP-NOTCAPTCHA: from n/a through <= 1.3.1.

    webjema WP-NOTCAPTCHA
  • High 8.6
    CVE-2024-13726 Scanner template

    Themes Coder <= 1.3.4 - Unauthenticated SQLi

    The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

    Web / CMS
  • High 7.1
    CVE-2024-13626

    VR Frases <= 3.0.1 - Reflected XSS

    The VR-Frases (collect & share quotes) WordPress plugin through 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

    Web / CMS
  • High 7.1
    CVE-2024-13625 Scanner template

    Tube Video Ads Lite <= 1.5.7 - Reflected XSS

    The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

    Web / CMS
  • High 7.2
    CVE-2025-0924 Public exploit

    WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting

    The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate…

    melapress WP Activity Log Web / CMS
  • High 8.8
    CVE-2025-1389

    Learning Digital Orca HCM - SQL Injection

    Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents.

    Learning Digital Orca HCM
  • High 8.8
    CVE-2025-1388

    Learning Digital Orca HCM - Arbitrary File Upload

    Orca HCM from LEARNING DIGITAL has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and run web shells

    Learning Digital Orca HCM