# CVEs published 2025-01-05

28 CVEs were published on January 5, 2025: 0 critical, 0 high. Days are UTC.

- [CVE-2024-13143](https://cve.now/CVE-2024-13143.md): ZeroWdd studentmanager PermissionController. java submitAddPermission cross site scripting (CVSS 5.1, ZeroWdd studentmanager)
- [CVE-2024-13142](https://cve.now/CVE-2024-13142.md): ZeroWdd studentmanager RoleController. java submitAddRole cross site scripting (CVSS 5.1, ZeroWdd studentmanager)
- [CVE-2025-0233](https://cve.now/CVE-2025-0233.md): Codezips Project Management System course.php sql injection (CVSS 6.9, Codezips Project Management System)
- [CVE-2025-0232](https://cve.now/CVE-2025-0232.md): Codezips Blood Bank Management System successadmin.php sql injection (CVSS 5.3, Codezips Blood Bank Management System)
- [CVE-2025-0231](https://cve.now/CVE-2025-0231.md): Codezips Gym Management System submit\_payments.php sql injection (CVSS 5.3, Codezips Gym Management System)
- [CVE-2025-0230](https://cve.now/CVE-2025-0230.md): code-projects Responsive Hotel Site print.php sql injection (CVSS 5.3, code-projects Responsive Hotel Site)
- [CVE-2025-0229](https://cve.now/CVE-2025-0229.md): code-projects Travel Management System enquiry.php sql injection (CVSS 5.3, code-projects Travel Management System)
- [CVE-2025-0228](https://cve.now/CVE-2025-0228.md): code-projects Local Storage Todo App index.html cross site scripting (CVSS 5.1, code-projects Local Storage Todo App)
- [CVE-2025-0227](https://cve.now/CVE-2025-0227.md): Tsinghua Unigroup Electronic Archives System downLoad.html information disclosure (CVSS 5.3, Tsinghua Unigroup Electronic Archives System)
- [CVE-2025-0226](https://cve.now/CVE-2025-0226.md): Tsinghua Unigroup Electronic Archives System downLoad.html download information disclosure (CVSS 5.3, Tsinghua Unigroup Electronic Archives System)
- [CVE-2025-0225](https://cve.now/CVE-2025-0225.md): Tsinghua Unigroup Electronic Archives System exampleDownload.html path traversal (CVSS 5.3, Tsinghua Unigroup Electronic Archives System)
- [CVE-2025-0224](https://cve.now/CVE-2025-0224.md): Provision-ISR SH-4050A-2 server.js information disclosure (CVSS 6.9, Provision-ISR SH-4050A-2 · Provision-ISR SH-4100A-2L +4)
- [CVE-2025-0223](https://cve.now/CVE-2025-0223.md): IObit Protected Folder IOCTL IURegistryFilter.sys 0x8001E010 null pointer dereference (CVSS 6.8, IObit Protected Folder)
- [CVE-2025-0222](https://cve.now/CVE-2025-0222.md): IObit Protected Folder IOCTL IUProcessFilter.sys 0x8001E004 null pointer dereference (CVSS 6.8, IObit Protected Folder)
- [CVE-2025-0221](https://cve.now/CVE-2025-0221.md): IOBit Protected Folder IOCTL pffilter.sys 0x22200c null pointer dereference (CVSS 6.8, IOBit Protected Folder)
- [CVE-2024-13141](https://cve.now/CVE-2024-13141.md): osuuu LightPicture SVG File Upload upload cross site scripting (CVSS 5.3, osuuu LightPicture)
- [CVE-2025-0220](https://cve.now/CVE-2025-0220.md): Trimble SPS851 Ethernet Configuration Menu cross site scripting (CVSS 5.1, Trimble SPS851)
- [CVE-2024-13140](https://cve.now/CVE-2024-13140.md): Emlog Pro Cover Upload article.php cross site scripting (CVSS 5.3, Emlog Pro)
- [CVE-2024-13139](https://cve.now/CVE-2024-13139.md): wangl1989 mysiteforme FileController doContent server-side request forgery (CVSS 5.3, wangl1989 mysiteforme)
- [CVE-2024-13138](https://cve.now/CVE-2024-13138.md): wangl1989 mysiteforme LocalUploadServiceImpl upload unrestricted upload (CVSS 5.1, wangl1989 mysiteforme)
- [CVE-2024-13137](https://cve.now/CVE-2024-13137.md): wangl1989 mysiteforme SiteController RestResponse cross site scripting (CVSS 5.1, wangl1989 mysiteforme)
- [CVE-2024-13136](https://cve.now/CVE-2024-13136.md): wangl1989 mysiteforme ShiroConfig.java rememberMeManager deserialization (CVSS 5.3, wangl1989 mysiteforme)
- [CVE-2024-13135](https://cve.now/CVE-2024-13135.md): Emlog Pro Subpage twitter.php cross site scripting (CVSS 5.3, Emlog Pro)
- [CVE-2024-13134](https://cve.now/CVE-2024-13134.md): ZeroWdd studentmanager TeacherController. java editTeacher unrestricted upload (CVSS 5.3, ZeroWdd studentmanager)
- [CVE-2025-0219](https://cve.now/CVE-2025-0219.md): Trimble SPS851 Receiver Status Identity Tab cross site scripting (CVSS 5.1, Trimble SPS851)
- [CVE-2024-13133](https://cve.now/CVE-2024-13133.md): ZeroWdd studentmanager StudentController. java editStudent unrestricted upload (CVSS 5.3, ZeroWdd studentmanager)
- [CVE-2024-13132](https://cve.now/CVE-2024-13132.md): Emlog Pro Subpage article.php cross site scripting (CVSS 5.3, Emlog Pro)
- [CVE-2024-13130](https://cve.now/CVE-2024-13130.md): Dahua IPC-HFW1200S Web Interface Sha1Account1 path traversal (CVSS 5.3, Dahua IPC-HFW1200S · Dahua IPC-HFW2300R-Z +2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.