# CVEs published 2025-01-03

53 CVEs were published on January 3, 2025: 6 critical, 20 high. Days are UTC.

- [CVE-2025-0199](https://cve.now/CVE-2025-0199.md): code-projects Point of Sales and Inventory Management System minus\_cart.php sql injection (CVSS 5.3, code-projects Point of Sales and Inventory Management System)
- [CVE-2024-55897](https://cve.now/CVE-2024-55897.md): IBM PowerHA SystemMirror for i information disclosure (CVSS 4.3, IBM i)
- [CVE-2024-55896](https://cve.now/CVE-2024-55896.md): IBM PowerHA SystemMirror for i clickjacking (CVSS 5.4, IBM i)
- [CVE-2024-11733](https://cve.now/CVE-2024-11733.md): WordPress Popular Posts \<= 7.1.0 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, hcabrera WP Popular Posts)
- [CVE-2024-12237](https://cve.now/CVE-2024-12237.md): Photo Gallery Slideshow & Masonry Tiled Gallery \<= 1.0.15 - Authenticated (Subscriber+) Limited Server-Side Request Forgery (CVSS 4.3, nik00726 Photo Gallery Slideshow & Masonry Tiled Gallery)
- [CVE-2024-13129](https://cve.now/CVE-2024-13129.md): Roxy-WI roxy.py action\_service os command injection (CVSS 8.7, Roxy-WI)
- [CVE-2025-0198](https://cve.now/CVE-2025-0198.md): code-projects Point of Sales and Inventory Management System search\_result.php sql injection (CVSS 5.3, code-projects Point of Sales and Inventory Management System)
- [CVE-2024-56332](https://cve.now/CVE-2024-56332.md): Next.js Vulnerable to Denial of Service (DoS) with Server Actions (CVSS 5.3, vercel next.js · next)
- [CVE-2025-0197](https://cve.now/CVE-2025-0197.md): code-projects Point of Sales and Inventory Management System search.php sql injection (CVSS 5.3, code-projects Point of Sales and Inventory Management System)
- [CVE-2025-0196](https://cve.now/CVE-2025-0196.md): code-projects Point of Sales and Inventory Management System plist.php sql injection (CVSS 5.3, code-projects Point of Sales and Inventory Management System)
- [CVE-2025-0195](https://cve.now/CVE-2025-0195.md): code-projects Point of Sales and Inventory Management System del\_product.php sql injection (CVSS 5.3, code-projects Point of Sales and Inventory Management System)
- [CVE-2024-56412](https://cve.now/CVE-2024-56412.md): PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters (CVSS 4.8, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-56411](https://cve.now/CVE-2024-56411.md): PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header (CVSS 4.8, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-56410](https://cve.now/CVE-2024-56410.md): PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties (CVSS 4.8, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-56409](https://cve.now/CVE-2024-56409.md): PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file (CVSS 8.3, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-56366](https://cve.now/CVE-2024-56366.md): PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file (CVSS 8.3, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-56365](https://cve.now/CVE-2024-56365.md): PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class (CVSS 8.3, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2025-21610](https://cve.now/CVE-2025-21610.md): Trix allows Cross-site Scripting via \`javascript:\` url in a link (CVSS 5.3, basecamp trix · trix)
- [CVE-2025-21609](https://cve.now/CVE-2025-21609.md): SiYuan has an arbitrary file deletion vulnerability (CVSS 8.7, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2024-56514](https://cve.now/CVE-2024-56514.md): Karmada Tar Slips in CRDs archive extraction (CVSS 5.3, karmada-io karmada · github.com/karmada-io/karmada)
- [CVE-2024-56513](https://cve.now/CVE-2024-56513.md): Karmada PULL Mode Cluster Privilege Escalation (CVSS 8.7, karmada-io karmada · github.com/karmada-io/karmada)
- [CVE-2024-56408](https://cve.now/CVE-2024-56408.md): PhpSpreadsheet allows unauthorized reflected XSS in \`Convert-Online.php\` file (CVSS 8.3, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-56324](https://cve.now/CVE-2024-56324.md): GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins (CVSS 2.1, gocd)
- [CVE-2024-56322](https://cve.now/CVE-2024-56322.md): GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality (CVSS 2.1, gocd)
- [CVE-2024-56321](https://cve.now/CVE-2024-56321.md): GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access (CVSS 3.8, gocd)
- [CVE-2024-56320](https://cve.now/CVE-2024-56320.md): GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user (CVSS 9.4, gocd)
- [CVE-2024-41780](https://cve.now/CVE-2024-41780.md): IBM Jazz Foundation information disclosure (CVSS 4.2, IBM Jazz Foundation)
- [CVE-2024-5591](https://cve.now/CVE-2024-5591.md): IBM Jazz Foundation information disclosure (CVSS 4.3, IBM Jazz Foundation)
- [CVE-2024-9140](https://cve.now/CVE-2024-9140.md): Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. (CVSS 9.3, Moxa EDR-8010 Series · Moxa EDR-G9004 Series +5)
- [CVE-2024-12132](https://cve.now/CVE-2024-12132.md): WP Job Portal – A Complete Recruitment System for Company or Job Board website \<= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference (CVSS 4.3, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-9138](https://cve.now/CVE-2024-9138.md): Privilege Escalation in Cellular Router, Secure Router, and Network Security Appliances (CVSS 8.6, Moxa EDR-810 Series · Moxa EDR-8010 Series +8)
- [CVE-2024-53842](https://cve.now/CVE-2024-53842.md): In cc\_SendCcImsInfoIndMsg of cc\_MmConManagement.c, there is a possible out of bounds write due to a missing bounds check. (CVSS 9.8, Google Android)
- [CVE-2024-53841](https://cve.now/CVE-2024-53841.md): In startListeningForDeviceStateChanges, there is a possible Permission Bypass due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2024-53840](https://cve.now/CVE-2024-53840.md): there is a possible biometric bypass due to an unusual root cause. (CVSS 7.8, Google Android)
- [CVE-2024-53839](https://cve.now/CVE-2024-53839.md): In GetCellInfoList() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2024-53838](https://cve.now/CVE-2024-53838.md): In Exynos\_parsing\_user\_data\_registered\_itu\_t\_t35 of VendorVideoAPI.cpp, there is a possible out of bounds write due to an incorrect bounds c (CVSS 7.8, Google Android)
- [CVE-2024-53837](https://cve.now/CVE-2024-53837.md): In prepare\_response of lwis\_periodic\_io.c, there is a possible out of bounds write due to an integer overflow. (CVSS 7.8, Google Android)
- [CVE-2024-53836](https://cve.now/CVE-2024-53836.md): In wbrc\_bt\_dev\_write of wb\_regon\_coordinator.c, there is a possible out of bounds write due to a buffer overflow. (CVSS 6.7, Google Android)
- [CVE-2024-53835](https://cve.now/CVE-2024-53835.md): there is a possible biometric bypass due to an unusual root cause. (CVSS 7.8, Google Android)
- [CVE-2024-53834](https://cve.now/CVE-2024-53834.md): In sms\_DisplayHexDumpOfPrivacyBuffer of sms\_Utilities.c, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 7.5, Google Android)
- [CVE-2024-53833](https://cve.now/CVE-2024-53833.md): In prepare\_response\_locked of lwis\_transaction.c, there is a possible out of bounds write due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2024-47032](https://cve.now/CVE-2024-47032.md): In construct\_transaction\_from\_cmd of lwis\_ioctl.c, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 7.8, Google Android)
- [CVE-2024-11624](https://cve.now/CVE-2024-11624.md): there is a possible to add apps to bypass VPN due to Undeclared Permission . (CVSS 7.8, Google Android)
- [CVE-2025-0176](https://cve.now/CVE-2025-0176.md): code-projects Point of Sales and Inventory Management System add\_cart.php sql injection (CVSS 5.3, code-projects Point of Sales and Inventory Management System)
- [CVE-2025-0175](https://cve.now/CVE-2025-0175.md): code-projects Online Shop view.php cross site scripting (CVSS 5.3, code-projects Online Shop)
- [CVE-2025-0174](https://cve.now/CVE-2025-0174.md): code-projects Point of Sales and Inventory Management System Parameter search\_result2.php sql injection (CVSS 5.3, code-projects Point of Sales and Inventory Management System)
- [CVE-2024-35365](https://cve.now/CVE-2024-35365.md): FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg\_mux\_init.c component of FFmpeg, specifically within the new\_stre (CVSS 8.8)
- [CVE-2024-36613](https://cve.now/CVE-2024-36613.md): FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a (CVSS 6.2)
- [CVE-2024-48814](https://cve.now/CVE-2024-48814.md): SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewType parameter of the f (CVSS 7.5)
- [CVE-2024-55078](https://cve.now/CVE-2024-55078.md): An arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0-JAVA v11.3.3 allows attackers to execute arbi (CVSS 9.8)
- [CVE-2024-55507](https://cve.now/CVE-2024-55507.md): An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete\_e.php component. (CVSS 9.8)
- [CVE-2025-22275](https://cve.now/CVE-2025-22275.md): iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by readin (CVSS 9.3, iTerm2)
- [CVE-2025-22376](https://cve.now/CVE-2025-22376.md): In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.