Skip to content
OpenAdvisories

Archive

28 February 2025

Vulnerabilities first published on this day (UTC), newest first.

← January 2025 2025 / February /28 March 2025 →
  1. 139
  2. 24
  3. 3187
  4. 4151
  5. 5119
  6. 699
  7. 7120
  8. 87
  9. 94
  10. 1081
  11. 11283
  12. 12265
  13. 13132
  14. 14134
  15. 1524
  16. 1640
  17. 1748
  18. 18162
  19. 19125
  20. 20120
  21. 2192
  22. 2234
  23. 2330
  24. 24119
  25. 25144
  26. 26795
  27. 27275
  28. 2887
All Critical High Medium Low Exploited only Public exploit

57 results · Clear filters · Feed

  • Medium 6.1
    CVE-2025-1505

    Advanced AJAX Product Filters <= 1.6.8.1 - Reflected Cross-Site Scripting

    The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.6.8.1 due to insufficient input sanitization and output escaping. This makes it possible f…

    BeRocket Advanced AJAX Product Filters Web / CMS
  • Medium 6.4
    CVE-2025-1757

    WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfhub_portfolio' and 'pfhub_portfolio_portfolio' shortcodes in all versions up to, and including, 1.1.7 due to insufficient…

    portfoliohub WordPress Portfolio Builder – Portfolio Gallery Web / CMS
  • Medium 5.3
    CVE-2024-13796

    Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.6 - Unauthenticated User Information Exposure

    The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.6 via the /wp-json/post-grid/v2/get_users REST API This makes it possible for unauthenticated attac…

    PickPlugins Post Grid Web / CMS
  • Medium 6.5
    CVE-2024-56340

    IBM Cognos Analytics path traversal

    IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 is vulnerable to local file inclusion vulnerability, allowing an attacker to access sensitive files by inserting path traversal payloads inside the deficon parameter.

    IBM Cognos Analytics
  • Medium 6.5
    CVE-2025-0823

    IBM MQ path traversal

    IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 and 12.0.0 through 12.0.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files …

    IBM Cognos Analytics
  • Medium 6.5
    CVE-2025-23225

    IBM MQ denial of service

    IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user to cause a denial of service due to the improper handling of invalid headers sent to the queue.

    IBM MQ
  • Medium 4.7
    CVE-2024-54173

    IBM MQ information disclosure

    IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled.

    IBM MQ
  • Medium 6.8
    CVE-2024-44754

    Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate a…

  • Medium 5.4
    CVE-2025-25461 Public exploit

    A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Categor…

  • Medium 5.4
    CVE-2025-25916

    wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php.

  • Medium 4.8
    CVE-2025-25431

    Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the The ssid key of wifi_da…

  • Medium 4.8
    CVE-2025-25429

    Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the r_name variable inside …

  • Medium 4.8
    CVE-2025-25430

    Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the configname parameter on…

  • Medium 6.5
    CVE-2025-25478

    The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This m…

  • Medium 5.4
    CVE-2025-25476

    A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to …

  • Medium 5.1
    CVE-2025-26047

    Loggrove v1.0 is vulnerable to SQL Injection in the read.py file.

  • Medium 5.1
    CVE-2025-26263 Public exploit

    GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to cre…