# CVEs published 2025-01-04

39 CVEs were published on January 4, 2025: 1 critical, 9 high. Days are UTC.

- [CVE-2025-0214](https://cve.now/CVE-2025-0214.md): TMD Custom Header Menu index.php sql injection (CVSS 2.1, TMD Custom Header Menu)
- [CVE-2025-0213](https://cve.now/CVE-2025-0213.md): Campcodes Project Management System update\_forms.php unrestricted upload (CVSS 5.3, Campcodes Project Management System)
- [CVE-2025-0212](https://cve.now/CVE-2025-0212.md): Campcodes Student Grading System view\_students.php sql injection (CVSS 5.3, Campcodes Student Grading System)
- [CVE-2025-0211](https://cve.now/CVE-2025-0211.md): Campcodes School Faculty Scheduling System index.php file inclusion (CVSS 5.3, Campcodes School Faculty Scheduling System)
- [CVE-2024-41763](https://cve.now/CVE-2024-41763.md): IBM Engineering Lifecycle Optimization - Publishing information disclosure (CVSS 5.9, IBM Engineering Lifecycle Optimization Publishing)
- [CVE-2024-41766](https://cve.now/CVE-2024-41766.md): IBM Engineering Lifecycle Optimization - Publishing denial of service (CVSS 7.5, IBM Engineering Lifecycle Optimization Publishing)
- [CVE-2024-41765](https://cve.now/CVE-2024-41765.md): IBM Engineering Lifecycle Optimization - Publishing directory traversal (CVSS 6.5, IBM Engineering Lifecycle Optimization Publishing)
- [CVE-2024-41767](https://cve.now/CVE-2024-41767.md): IBM Engineering Lifecycle Optimization - Publishing SQL injection (CVSS 7.3, IBM Engineering Lifecycle Optimization Publishing)
- [CVE-2024-41768](https://cve.now/CVE-2024-41768.md): IBM Engineering Lifecycle Optimization - Publishing unhandled SLL exception (CVSS 6.5, IBM Engineering Lifecycle Optimization Publishing)
- [CVE-2025-0210](https://cve.now/CVE-2025-0210.md): Campcodes School Faculty Scheduling System ajax.php sql injection (CVSS 6.9, Campcodes School Faculty Scheduling System)
- [CVE-2024-10957](https://cve.now/CVE-2024-10957.md): UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection (CVSS 8.8, davidanderson UpdraftPlus: WP Backup & Migration Plugin)
- [CVE-2025-0208](https://cve.now/CVE-2025-0208.md): code-projects Online Shoe Store summary.php sql injection (CVSS 5.3, code-projects Online Shoe Store)
- [CVE-2025-0207](https://cve.now/CVE-2025-0207.md): code-projects Online Shoe Store login.php sql injection (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2025-0206](https://cve.now/CVE-2025-0206.md): code-projects Online Shoe Store index.php access control (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2024-12195](https://cve.now/CVE-2024-12195.md): WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts \<= 2.6.16 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, wedevs Project Manager – AI Powered Project Management, Tas…)
- [CVE-2024-12279](https://cve.now/CVE-2024-12279.md): WP Social AutoConnect \<= 4.6.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1, justin\_k WP Social AutoConnect)
- [CVE-2024-12475](https://cve.now/CVE-2024-12475.md): WP Multi Store Locator \<= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpexpertsio WP Multistore Locator — WP Store Locator Plugin…)
- [CVE-2024-12221](https://cve.now/CVE-2024-12221.md): Turnkey bbPress by WeaverTheme \<= 1.6.3 - Reflected Cross-Site Scripting via \_wpnonce Parameter (CVSS 6.1, wpweaver Turnkey bbPress by WeaverTheme)
- [CVE-2025-0205](https://cve.now/CVE-2025-0205.md): code-projects Online Shoe Store details2.php sql injection (CVSS 5.3, code-projects Online Shoe Store)
- [CVE-2024-11930](https://cve.now/CVE-2024-11930.md): Taskbuilder – WordPress Project & Task Management plugin \<= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm\_tasks Shortcode (CVSS 6.4, Taskbuilder – Project Management & Task Management Tool Wit…)
- [CVE-2024-12583](https://cve.now/CVE-2024-12583.md): Dynamics 365 Integration \<= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection (CVSS 9.9, alexacrm Dynamics 365 Integration)
- [CVE-2025-0204](https://cve.now/CVE-2025-0204.md): code-projects Online Shoe Store details.php sql injection (CVSS 5.3, code-projects Online Shoe Store)
- [CVE-2024-10932](https://cve.now/CVE-2024-10932.md): Backup Migration \<= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive\_unserialize\_replace' (CVSS 8.8, inisev BackupBliss – Backup & Migration with Free Cloud Sto…)
- [CVE-2024-12545](https://cve.now/CVE-2024-12545.md): Scratch & Win – Giveaways and Contests \<= 2.7.1 - Cross-Site Request Forgery via reset\_installation Function (CVSS 5.4, akashmalik Scratch & Win – Giveaways and Contests. Boost su…)
- [CVE-2024-11974](https://cve.now/CVE-2024-11974.md): Media Library Assistant \<= 3.23 - Reflected Cross-Site Scripting via smc\_settings\_tab, unattachfixit-action, and woofixit-action Parameters (CVSS 6.1, dglingren Media Library Assistant)
- [CVE-2024-12701](https://cve.now/CVE-2024-12701.md): WP Smart Import : Import any XML File to WordPress \<= 1.1.2 - Reflected Cross-Site Scripting (CVSS 6.1, xylus WP Smart Import : Import any XML File to WordPress)
- [CVE-2024-12047](https://cve.now/CVE-2024-12047.md): WP Compress – Instant Performance & Speed Optimization \<= 6.30.03 - Reflected Cross-Site Scripting via custom\_server Parameter (CVSS 6.1, aresit WP Compress – Instant Performance & Speed Optimizati…)
- [CVE-2025-0203](https://cve.now/CVE-2025-0203.md): code-projects Student Management System DbFunction.php showSubject1 sql injection (CVSS 5.3, code-projects Student Management System)
- [CVE-2025-0202](https://cve.now/CVE-2025-0202.md): TCS BaNCS REPORTS\_SHOW\_FILE.jsp file inclusion (CVSS 5.1, TCS BaNCS)
- [CVE-2025-0201](https://cve.now/CVE-2025-0201.md): code-projects Point of Sales and Inventory Management System update\_account.php sql injection (CVSS 5.3, code-projects Point of Sales and Inventory Management System)
- [CVE-2025-0200](https://cve.now/CVE-2025-0200.md): code-projects Point of Sales and Inventory Management System search\_num.php sql injection (CVSS 5.3, code-projects Point of Sales and Inventory Management System)
- [CVE-2025-22383](https://cve.now/CVE-2025-22383.md): An issue was discovered in Optimizely Configured Commerce before 5.2.2408. (CVSS 4.6)
- [CVE-2025-22384](https://cve.now/CVE-2025-22384.md): An issue was discovered in Optimizely Configured Commerce before 5.2.2408. (CVSS 7.5)
- [CVE-2025-22385](https://cve.now/CVE-2025-22385.md): An issue was discovered in Optimizely Configured Commerce before 5.2.2408. (CVSS 5.9)
- [CVE-2025-22386](https://cve.now/CVE-2025-22386.md): An issue was discovered in Optimizely Configured Commerce before 5.2.2408. (CVSS 7.3)
- [CVE-2025-22387](https://cve.now/CVE-2025-22387.md): An issue was discovered in Optimizely Configured Commerce before 5.2.2408. (CVSS 7.5)
- [CVE-2025-22388](https://cve.now/CVE-2025-22388.md): An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. (CVSS 5.7)
- [CVE-2025-22389](https://cve.now/CVE-2025-22389.md): An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. (CVSS 8.0)
- [CVE-2025-22390](https://cve.now/CVE-2025-22390.md): An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.