# CVEs published 2025-01-10

72 CVEs were published on January 10, 2025: 15 critical, 17 high. Days are UTC.

- [CVE-2024-9188](https://cve.now/CVE-2024-9188.md): Specially constructed queries cause cross platform scripting leaking administrator tokens (CVSS 8.8, Arista Networks Arista Edge Threat Management)
- [CVE-2024-47520](https://cve.now/CVE-2024-47520.md): A user with advanced report application access rights can perform actions for which they are not authorized (CVSS 7.6, Arista Networks Arista Edge Threat Management)
- [CVE-2024-47519](https://cve.now/CVE-2024-47519.md): Backup uploads to ETM subject to man-in-the-middle interception (CVSS 8.3, Arista Networks Arista Edge Threat Management)
- [CVE-2024-47518](https://cve.now/CVE-2024-47518.md): Specially constructed queries targeting ETM could discover active remote access sessions (CVSS 6.4, Arista Networks Arista Edge Threat Management)
- [CVE-2024-47517](https://cve.now/CVE-2024-47517.md): Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access (CVSS 6.8, Arista Networks Arista Edge Threat Management)
- [CVE-2024-9134](https://cve.now/CVE-2024-9134.md): Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can… (CVSS 8.3, Arista Networks Arista Edge Threat Management)
- [CVE-2024-9133](https://cve.now/CVE-2024-9133.md): A user with administrator privileges is able to retrieve authentication tokens (CVSS 6.6, Arista Networks Arista Edge Threat Management)
- [CVE-2024-9132](https://cve.now/CVE-2024-9132.md): The administrator is able to configure an insecure captive portal script (CVSS 8.1, Arista Networks Arista Edge Threat Management)
- [CVE-2024-9131](https://cve.now/CVE-2024-9131.md): A user with administrator privileges can perform command injection (CVSS 7.2, Arista Networks Arista Edge Threat Management)
- [CVE-2024-7142](https://cve.now/CVE-2024-7142.md): On Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only)… (CVSS 4.6, Arista Networks CloudVision Appliance)
- [CVE-2024-5872](https://cve.now/CVE-2024-5872.md): On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause… (CVSS 6.5, Arista Networks EOS)
- [CVE-2024-7095](https://cve.now/CVE-2024-7095.md): On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances… (CVSS 4.3, Arista Networks EOS)
- [CVE-2024-6437](https://cve.now/CVE-2024-6437.md): On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based… (CVSS 5.8, Arista Networks EOS-Policy Based Routing · Arista Networ… +1)
- [CVE-2024-12847](https://cve.now/CVE-2024-12847.md): NETGEAR DGN setup.cgi OS Command Injection (CVSS 9.8, NETGEAR DGN1000)
- [CVE-2025-23079](https://cve.now/CVE-2025-23079.md): XSSes in Extension:ArticleFeedbackv5 (CVSS 6.1, Wikimedia Foundation Mediawiki - ArticleFeedbackv5 extension)
- [CVE-2025-23078](https://cve.now/CVE-2025-23078.md): XSS in BreadCrumbs2 (CVSS 6.5, Wikimedia Foundation Mediawiki - Breadcrumbs2 extension)
- [CVE-2024-6880](https://cve.now/CVE-2024-6880.md): CSRF in MegaBIP (CVSS 6.9, Jan Syski MegaBIP)
- [CVE-2024-6662](https://cve.now/CVE-2024-6662.md): CSRF in MegaBIP (CVSS 8.7, Jan Syski MegaBIP)
- [CVE-2025-22600](https://cve.now/CVE-2025-22600.md): WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint \`configuracao\_doacao.php\` parameter \`avulso\` (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-22599](https://cve.now/CVE-2025-22599.md): WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint \`home.php\` parameter \`msg\_c\` (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-22598](https://cve.now/CVE-2025-22598.md): WeGIA has a Cross-Site Scripting (XSS) Stored endpoint 'cadastrarSocio.php' parameter 'nome' (CVSS 8.3, LabRedesCefetRJ WeGIA)
- [CVE-2025-22597](https://cve.now/CVE-2025-22597.md): WeGIA has a Cross-Site Scripting (XSS) Stored endpoint 'CobrancaController.php' parameter 'local\_recepcao' (CVSS 8.3, LabRedesCefetRJ WeGIA)
- [CVE-2025-22596](https://cve.now/CVE-2025-22596.md): WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint 'modulos\_visiveis.php' parameter'msg\_c' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-22152](https://cve.now/CVE-2025-22152.md): Improper Path Validation Enables Path Traversal in Multiple Components in Atheos (CVSS 9.4, Atheos)
- [CVE-2024-56511](https://cve.now/CVE-2024-56511.md): DataEase has an unauthorized vulnerability (CVSS 9.3, dataease)
- [CVE-2024-41787](https://cve.now/CVE-2024-41787.md): IBM Engineering Requirements Management DOORS Next code execution (CVSS 9.8, IBM Engineering Requirements Management DOORS Next)
- [CVE-2024-13318](https://cve.now/CVE-2024-13318.md): Essential WP Real Estate \<= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletion (CVSS 5.3, smartdatasoft Essential WP Real Estate)
- [CVE-2024-13183](https://cve.now/CVE-2024-13183.md): Orbit Fox by ThemeIsle \<= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title\_tag Parameter (CVSS 6.4, themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…)
- [CVE-2025-0311](https://cve.now/CVE-2025-0311.md): Orbit Fox by ThemeIsle \<= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget (CVSS 6.4, themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…)
- [CVE-2024-12473](https://cve.now/CVE-2024-12473.md): AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) \<=… (CVSS 6.5, opacewebdesign Opace AI Scribe: SEO Content Creator & Humai…)
- [CVE-2024-12606](https://cve.now/CVE-2024-12606.md): AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) \<=… (CVSS 4.3, opacewebdesign Opace AI Scribe: SEO Content Creator & Humai…)
- [CVE-2024-25371](https://cve.now/CVE-2024-25371.md): Gramine before a390e33e16ed374a40de2344562a937f289be2e1 suffers from an Interface vulnerability due to mismatching SW signals vs HW… (CVSS 7.5)
- [CVE-2024-29970](https://cve.now/CVE-2024-29970.md): Fortanix Enclave OS 3.36.1941-EM has an interface vulnerability that leads to state corruption via injected signals. (CVSS 9.8)
- [CVE-2024-29971](https://cve.now/CVE-2024-29971.md): Scontain SCONE 5.8.0 has an interface vulnerability that leads to state corruption via injected signals. (CVSS 9.8)
- [CVE-2024-33297](https://cve.now/CVE-2024-33297.md): Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name… (CVSS 4.7, microweber/microweber)
- [CVE-2024-33298](https://cve.now/CVE-2024-33298.md): Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new… (CVSS 6.1, microweber/microweber)
- [CVE-2024-33299](https://cve.now/CVE-2024-33299.md): Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last… (CVSS 4.7, microweber/microweber)
- [CVE-2024-46210](https://cve.now/CVE-2024-46210.md): An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via… (CVSS 7.2)
- [CVE-2024-50807](https://cve.now/CVE-2024-50807.md): Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting (XSS) via file upload using the svg and pdf extensions. (CVSS 6.1)
- [CVE-2024-54687](https://cve.now/CVE-2024-54687.md): Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in… (CVSS 6.1)
- [CVE-2024-54846](https://cve.now/CVE-2024-54846.md): An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the EC private key and access sensitive data or execute a… (CVSS 5.9)
- [CVE-2024-54847](https://cve.now/CVE-2024-54847.md): An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to access the Diffie-Hellman (DH) parameters and access sensitive data or… (CVSS 5.9)
- [CVE-2024-54848](https://cve.now/CVE-2024-54848.md): Improper handling and storage of certificates in CP Plus CP-VNR-3104 B3223P22C02424 allow attackers to decrypt communications or execute a… (CVSS 7.4)
- [CVE-2024-54849](https://cve.now/CVE-2024-54849.md): An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the second RSA private key and access sensitive data or execute… (CVSS 5.9)
- [CVE-2024-54910](https://cve.now/CVE-2024-54910.md): Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function. (CVSS 4.7)
- [CVE-2024-54994](https://cve.now/CVE-2024-54994.md): MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first\_name and last\_name parameters in… (CVSS 6.5)
- [CVE-2024-54996](https://cve.now/CVE-2024-54996.md): MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description… (CVSS 8.8)
- [CVE-2024-54997](https://cve.now/CVE-2024-54997.md): MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at… (CVSS 5.4)
- [CVE-2024-54998](https://cve.now/CVE-2024-54998.md): MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at… (CVSS 5.4)
- [CVE-2024-57211](https://cve.now/CVE-2024-57211.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the… (CVSS 8.0)
- [CVE-2024-57212](https://cve.now/CVE-2024-57212.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parameter in the… (CVSS 5.1)
- [CVE-2024-57213](https://cve.now/CVE-2024-57213.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newpasswd parameter in the… (CVSS 6.3)
- [CVE-2024-57214](https://cve.now/CVE-2024-57214.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname parameter in the… (CVSS 6.3)
- [CVE-2024-57222](https://cve.now/CVE-2024-57222.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli\_cancel\_wps… (CVSS 6.3)
- [CVE-2024-57223](https://cve.now/CVE-2024-57223.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli\_wps\_gen\_pincode… (CVSS 9.8)
- [CVE-2024-57224](https://cve.now/CVE-2024-57224.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli\_do\_enr\_pin\_wps… (CVSS 9.8)
- [CVE-2024-57225](https://cve.now/CVE-2024-57225.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset\_wifi function. (CVSS 9.8)
- [CVE-2024-57226](https://cve.now/CVE-2024-57226.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif\_enable function. (CVSS 8.0)
- [CVE-2024-57227](https://cve.now/CVE-2024-57227.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli\_do\_enr\_pbc\_wps… (CVSS 8.0)
- [CVE-2024-57228](https://cve.now/CVE-2024-57228.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif\_disable function. (CVSS 8.0)
- [CVE-2024-57686](https://cve.now/CVE-2024-57686.md): A Cross Site Scripting (XSS) vulnerability was found in /landrecordsys/admin/contactus.php in PHPGurukul Land Record System v1.0, which… (CVSS 9.8)
- [CVE-2024-57687](https://cve.now/CVE-2024-57687.md): An OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows… (CVSS 9.8)
- [CVE-2024-57822](https://cve.now/CVE-2024-57822.md): In Raptor RDF Syntax Library through 2.0.16, there is a heap-based buffer over-read when parsing triples with the nquads parser in… (CVSS 4.0, librdf Raptor RDF Syntax Library)
- [CVE-2024-57823](https://cve.now/CVE-2024-57823.md): In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in… (CVSS 9.3, librdf Raptor RDF Syntax Library)
- [CVE-2025-22946](https://cve.now/CVE-2025-22946.md): Tenda ac9 v1.0 firmware v15.03.05.19 contains a stack overflow vulnerability in /goform/SetOnlineDevName, which may lead to remote… (CVSS 9.8)
- [CVE-2025-22949](https://cve.now/CVE-2025-22949.md): Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote arbitrary code… (CVSS 9.8)
- [CVE-2025-23016](https://cve.now/CVE-2025-23016.md): FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or… (CVSS 9.3, FastCGI fcgi)
- [CVE-2025-23022](https://cve.now/CVE-2025-23022.md): FreeType 2.8.1 has a signed integer overflow in cf2\_doFlex in cff/cf2intrp.c. (CVSS 4.0, FreeType)
- [CVE-2025-23110](https://cve.now/CVE-2025-23110.md): An issue was discovered in REDCap 14.9.6. (CVSS 6.1, Vanderbilt REDCap)
- [CVE-2025-23111](https://cve.now/CVE-2025-23111.md): An issue was discovered in REDCap 14.9.6. (CVSS 4.7, Vanderbilt REDCap)
- [CVE-2025-23112](https://cve.now/CVE-2025-23112.md): An issue was discovered in REDCap 14.9.6. (CVSS 6.1, Vanderbilt REDCap)
- [CVE-2025-23113](https://cve.now/CVE-2025-23113.md): An issue was discovered in REDCap 14.9.6. (CVSS 3.4, Vanderbilt REDCap)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2025-01-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.