CVEs published January 9, 2025
267 CVEs were published on January 9, 2025: 36 critical, 62 high. 1 is now in CISA KEV.
- Published
- 267
- Critical
- 36
- High
- 62
- Medium
- 160
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 114
Most affected products
- Iocharger firmware for AC models
- 15
- SonicWall SonicOS
- 9
- Juniper Networks Junos OS
- 6
- Drupal Open Social
- 4
- leiyuxi cy-fast
- 4
- donglight bookstore电商书城系统说明
- 3
- kurniaramadhan E-Commerce-PHP
- 3
- SingMR HouseRent
- 3
- vaultwarden
- 3
- wander-chu SpringBoot-Blog
- 3
Critical 36
- CVE-2024-13285wkhtmltopdf - Highly critical - Unsupported - SA-CONTRIB-2024-049Drupal wkhtmltopdf · drupal/wkhtmltopdf
- CVE-2024-13281Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045Drupal Monster Menus · drupal/monster_menus
- CVE-2024-13280Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044Drupal Persistent Login · drupal/persistent_login
- CVE-2024-13279Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043Drupal Two-factor Authentication · drupal/tfa
- CVE-2024-13278Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042Drupal Diff · drupal/diff
- CVE-2024-13277Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041Drupal Smart IP Ban
- CVE-2024-10215WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password ChangeIqonic Design WPBookit
- CVE-2024-13264Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028Drupal Opigno module · drupal/opigno_module
- CVE-2024-13258Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022Drupal REST & JSON API Authentication · drupal/rest_api_aut…
- CVE-2024-13253Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017Drupal Advanced PWA inc Push Notifications · drupal/advance…
- CVE-2024-13242Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006Drupal Swift Mailer · drupal/swiftmailer
- CVE-2024-13241Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005Drupal Open Social
- CVE-2024-13239Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003Drupal Two-factor Authentication · drupal/tfa
- CVE-2025-21628Chatwoot has a Blind SQL-injection in Conversation and Contacts filterschatwoot
- CVE-2025-22504WordPress 4ECPS Web Forms Plugin <= 0.2.18 - Arbitrary File Upload vulnerabilityjumpdemand 4ECPS Web Forms
- CVE-2025-22540WordPress Emailing Subscription Plugin <= 1.4.1 - SQL Injection vulnerabilityseballero Emailing Subscription
- CVE-2025-22542WordPress Virtual Bot Plugin <= 1.0.0 - SQL Injection vulnerabilityOfek Nakar Virtual Bot
- CVE-2024-11642Post Grid Master <= 3.4.12 - Missing Authorization to Unauthenticated Local PHP File Inclusionmdshuvo Post Grid Master — Post Grids & AJAX Filters
- CVE-2024-12802SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (SecurSonicWall SonicOS
- CVE-2024-43651Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging stationIocharger firmware for AC models
- CVE-2024-43654Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging stationIocharger firmware for AC models
- CVE-2024-43649Authenticated command injection via <redacted>.exe <redacted> parameterIocharger firmware for AC models
- CVE-2024-43653Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging stationIocharger firmware for AC models
- CVE-2024-43652Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging stationIocharger firmware for AC chargers
- CVE-2024-43657When uploading new firmware, a shell script inside a firmware file is executed during its processing. This can be used to craft a custom firmware file with a custom script with arbitrary code, which will then be executed on the charging station.Iocharger firmware for AC models
- CVE-2024-43648Authenticated command injection via <redacted>.exe <redacted> parameterIocharger firmware for AC models
- CVE-2024-43656A backup can be manipulated and then restored to create arbitrary files inside the <redacted> directory. A CGI script can be added to the web directory this way, allowing for full remote code execution.Iocharger firmware for AC models
- CVE-2024-43650Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging stationIocharger firmware for AC models
- CVE-2024-43655Any authenticated users can execute OS commands as root using the <redacted>.sh CGI script.Iocharger firmware for AC models
- CVE-2024-40765An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of SSonicWall SonicOS
- CVE-2024-40762Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain caSonicWall SonicOS
- CVE-2023-28354An issue was discovered in Opsview Monitor Agent 6.8.
- CVE-2024-46505Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.
- CVE-2024-54724PHPYun before 7.0.2 is vulnerable to code execution through backdoor-restricted arbitrary file writing and file inclusion.
- CVE-2024-55224An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload ivaultwarden
- CVE-2024-55225An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administratorvaultwarden
High 62
- CVE-2025-21380Azure Marketplace SaaS Resources Information Disclosure VulnerabilityMicrosoft Marketplace SaaS
- CVE-2025-21385Microsoft Purview Information Disclosure VulnerabilityMicrosoft Purview
- CVE-2024-13311Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075Drupal Allow All File Extensions for file fields · drupal/a…
- CVE-2024-13291Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057Drupal Basic HTTP Authentication
- CVE-2024-13284Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048Drupal Gutenberg · drupal/gutenberg
- CVE-2024-13282Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046Drupal Block permissions · drupal/block_permissions
- CVE-2024-13276File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040Drupal File Entity
- CVE-2024-13267Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031Drupal Opigno TinCan Question Type
- CVE-2024-13265Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029Drupal Opigno Learning path · drupal/opigno_learning_path
- CVE-2024-13260Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024Drupal Migrate queue importer · drupal/migrate_queue_import…
- CVE-2024-13259Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023Drupal Image Sizes · drupal/image_sizes
- CVE-2024-13256Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020Drupal Email Contact · drupal/email_contact
- CVE-2024-13255RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019Drupal RESTful Web Services
- CVE-2024-13254REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018Drupal REST Views · drupal/rest_views
- CVE-2024-13251Registration role - Critical - Access bypass - SA-CONTRIB-2024-015Drupal Registration role · drupal/registration_role
- CVE-2024-13250Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014Drupal Symfony Mailer Lite · drupal/symfony_mailer_lite
- CVE-2024-13244Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008Drupal Migrate Tools · drupal/migrate_tools
- CVE-2024-13240Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004Drupal Open Social
- CVE-2025-21598Junos OS and Junos OS Evolved: When BGP traceoptions are configured, receipt of malformed BGP packets causes RPD to crashJuniper Networks Junos OS
- CVE-2025-21599Junos OS Evolved: Receipt of specifically malformed IPv6 packets causes kernel memory exhaustion leading to Denial of ServiceJuniper Networks Junos OS Evolved
- CVE-2025-22295WordPress Tripetto plugin <= 8.0.6 - Cross Site Scripting (XSS) vulnerabilityWordPress form builder plugin for contact forms, surveys an…
- CVE-2025-22307WordPress Product Table for WooCommerce plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilitySaiful Islam Product Table for WooCommerce
- CVE-2025-22313WordPress Widgetize Pages Light plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityOTWthemes Widgetize Pages Light
- CVE-2025-22330WordPress MG Parallax Slider plugin <= 1.0. - Reflected Cross Site Scripting (XSS) vulnerabilityMahesh Waghmare MG Parallax Slider
- CVE-2025-22331WordPress Cf7Save Extension plugin <= 1 - Reflected Cross Site Scripting (XSS) vulnerabilityP3JX Cf7Save Extension
- CVE-2025-22345WordPress TS Comfort DB plugin <= 2.0.7 - Reflected Cross Site Scripting (XSS) vulnerabilitytsinf TS Comfort DB
- CVE-2025-22361WordPress Opentracker Analytics Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityOpentracker Analytics
- CVE-2025-22505WordPress NC Wishlist for Woocommerce Plugin <= 1.0.1 - SQL Injection vulnerabilityCrispweb NC Wishlist for Woocommerce
- CVE-2025-22508WordPress FAT Event Lite plugin <= 1.1 - Unauthenticated Non-Arbitrary Local File Inclusion vulnerabilityroninwp FAT Event Lite
- CVE-2025-22510WordPress WC Price History for Omnibus plugin <= 2.1.4 - PHP Object Injection vulnerabilitykkarpieszuk WC Price History for Omnibus
- CVE-2025-22521WordPress wp Hosting Performance Check Plugin <= 2.18.8 - Reflected Cross Site Scripting (XSS) vulnerabilityScott Farrell wp Hosting Performance Check
- CVE-2025-22527WordPress Mailing Group Listserv Plugin <= 2.0.9 - SQL Injection vulnerabilityYamna Khawaja Mailing Group Listserv
- CVE-2025-22535WordPress WPListCal Plugin <= 1.3.5 - SQL Injection vulnerabilityjonkern WPListCal
- CVE-2025-22537WordPress Google Maps Travel Route Plugin <= 1.3.1 - SQL Injection vulnerabilitytraveller11 Google Maps Travel Route
- CVE-2025-22539WordPress Custom DataBase Tables Plugin <= 2.1.34 - Reflected Cross Site Scripting (XSS) vulnerabilityka2 Custom DataBase Tables
- CVE-2025-22594WordPress Better User Shortcodes Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityhccoder Better User Shortcodes
- CVE-2025-22595WordPress Mailing Group Listserv Plugin <= 2.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityYamna Khawaja Mailing Group Listserv
- CVE-2025-22814WordPress Zephyr Admin Theme Plugin <= 1.4.1 - CSRF to Stored XSS vulnerabilityDylan James Zephyr Admin Theme
- CVE-2023-24012Data Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Open DDSOpenDDS DDS
- CVE-2023-24011Data Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Cyclone DDSZettaScale DDS
- CVE-2023-24010Data Distribution Service (DDS) Chain of Trust (CoT) violation in Fast DDSeProsima DDS
- CVE-2024-12542linkID <= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information ExposurelinkID
- CVE-2024-12848SKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Uploadsonalsinha21 SKT Page Builder
- CVE-2024-12330WP Database Backup – Unlimited Database & Files Backup by Backup for WP <= 7.3 - Unauthenticated Database Back-Up Exposuredatabasebackup WP Database Backup – Unlimited Database & Fi…
- CVE-2025-0349Tenda AC6 GetParentControlInfo stack-based overflowTenda AC6
- CVE-2024-43658Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal.Iocharger firmware for AC models
- CVE-2024-43660Arbitrary file download using <redacted>.shIocharger firmware for AC models
- CVE-2024-43661Buffer overflow in <redacted>.so leads to DoS of OCPP serviceIocharger firmware for AC models
- CVE-2024-43659Plaintext default credentials in firmwareIocharger firmware for AC models
- CVE-2023-1907Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong sessionpgadmin · pgadmin4
- CVE-2024-12805A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads tSonicWall SonicOS
- CVE-2024-12803A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and potenSonicWall SonicOS
- CVE-2024-53706A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-privileged attacker to elevate privileges toSonicWall SonicOS
- CVE-2024-53705A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection tSonicWall SonicOS
- CVE-2024-53704An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.SonicWall SonicOS
- CVE-2025-0306Ruby: openssl: ruby marvin attackRuby · Red Hat Enterprise Linux +1
- CVE-2024-13206REVE Antivirus reveinstall default permissionREVE Antivirus
- CVE-2024-27980Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject aNodeJS Node
- CVE-2024-46464In PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user access can be manipulated to render the host
- CVE-2024-51229Cross Site Scripting vulnerability in LinZhaoguan pb-cms v.2.0 allows a remote attacker to execute arbitrary code via the theme management f
- CVE-2024-54887TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /user
- CVE-2024-56113Smart Toilet Lab - Motius 1.3.11 is running with debug mode turned on (DEBUG = True) and exposing sensitive information defined in Django se
Medium, low and unrated 169
- CVE-2024-13312Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076Drupal Open Social
- CVE-2024-13310Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074Git Utilities for Drupal · drupal/git_utils
- CVE-2024-13309Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073Drupal Login Disable · drupal/login_disable
- CVE-2024-13308Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072Drupal Browser Back Button · drupal/browser_back_button
- CVE-2024-13305Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071Drupal Entity Form Steps · drupal/entity_form_steps
- CVE-2024-13304Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070Drupal Minify JS · drupal/minifyjs
- CVE-2024-13303Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069Drupal Download All Files · drupal/download_all_files
- CVE-2024-13302Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068Drupal Pages Restriction Access · drupal/pages_restriction
- CVE-2024-13301OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067Drupal OAuth & OpenID Connect Single Sign On – SSO · drupal…
- CVE-2024-13300Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066Drupal Print Anything
- CVE-2024-13299Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065Drupal Megamenu Framework
- CVE-2024-13298Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064Drupal Tarte au Citron · drupal/tarte_au_citron
- CVE-2024-13297Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063Drupal Eloqua
- CVE-2024-13296Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062Drupal Mailjet · drupal/mailjet
- CVE-2024-13295Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061Drupal Node export
- CVE-2024-13294POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060Drupal POST File · drupal/postfile
- CVE-2024-13293POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059Drupal POST File · drupal/postfile
- CVE-2024-13292Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058Drupal Tooltip · drupal/tooltip
- CVE-2024-13290OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056Drupal OhDear Integration · drupal/ohdear_integration
- CVE-2024-13289Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055Drupal Cookiebot + GTM · drupal/cookiebot_gtm
- CVE-2024-13288Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052Drupal Monster Menus · drupal/monster_menus
- CVE-2024-13287Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051Drupal Views SVG Animation · drupal/views_svg_animation
- CVE-2024-13286SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050Drupal SVG Embed · drupal/svg_embed
- CVE-2024-13283Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047Drupal Facets · drupal/facets
- CVE-2024-13275Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039Drupal Security Kit · drupal/seckit
- CVE-2024-13274Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038Drupal Open Social · goalgorilla/open_social
- CVE-2024-13273Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037Drupal Open Social
- CVE-2024-13272Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036Drupal Paragraphs table · drupal/paragraphs_table
- CVE-2024-13271Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035Drupal Content Entity Clone · drupal/content_entity_clone
- CVE-2024-13270Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034Drupal Freelinking · drupal/freelinking
- CVE-2024-13269Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033Drupal Advanced Varnish · drupal/adv_varnish
- CVE-2024-13268Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032Drupal Opigno
- CVE-2024-13266Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030Drupal Responsive and off-canvas menu · drupal/responsive_m…
- CVE-2024-13263Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027Drupal Opigno group manager · drupal/opigno_group_manager
- CVE-2024-13262View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026Drupal View Password · drupal/view_password
- CVE-2024-13261Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025Drupal Acquia DAM · drupal/acquia_dam
- CVE-2024-13257Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021Drupal Commerce View Receipt · drupal/commerce_view_receipt
- CVE-2024-13252TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016Drupal TacJS · drupal/tacjs
- CVE-2024-13249Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013Drupal Node Access Rebuild Progressive
- CVE-2024-13248Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012Drupal Private content · drupal/private_content
- CVE-2024-13247Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011Drupal Coffee · drupal/coffee
- CVE-2024-13246Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010Drupal Node Access Rebuild Progressive · drupal/node_access…
- CVE-2025-22151Strawberry GraphQL has a type resolution vulnerabilitystrawberry-graphql strawberry · strawberry-graphql
- CVE-2024-13245CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009Drupal CKEditor 4 LTS - WYSIWYG HTML editor · drupal/ckedit…
- CVE-2024-13243Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007Drupal Entity Delete Log · drupal/entity_delete_log
- CVE-2024-13238Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002Drupal Typogrify · drupal/typogrify
- CVE-2024-13237File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001Drupal File Entity
- CVE-2025-22149JWK Set's HTTP client only overwrites and appends JWK to local cache during refreshMicahParks jwkset · github.com/MicahParks/jwkset
- CVE-2025-21600Junos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crashJuniper Networks Junos OS
- CVE-2025-21602Junos OS and Junos OS Evolved: Receipt of specially crafted BGP update packet causes RPD crashJuniper Networks Junos OS
- CVE-2025-21596Junos OS: SRX1500,SRX4100,SRX4200: Execution of low-privileged CLI command results in chassisd crashJuniper Networks Junos OS
- CVE-2025-21593Junos OS and Junos OS Evolved: On SRv6 enabled devices, an attacker sending a malformed BGP update can cause the rpd to crashJuniper Networks Junos OS
- CVE-2025-21592Junos OS: SRX Series: Low privileged user able to access highly sensitive information on file systemJuniper Networks Junos OS
- CVE-2025-22561WordPress Title Experiments Free plugin <= 9.0.4 - Broken Access Control vulnerabilitykbowson Title Experiments Free
- CVE-2025-22801WordPress Free WooCommerce Theme 99fy Extension plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerabilityHasThemes Free WooCommerce Theme 99fy Extension
- CVE-2025-22802WordPress Email Templates Customizer YeeMail plugin <= 2.1.4 - Cross Site Scripting (XSS) vulnerabilityadd-ons.org Email Templates Customizer for WordPress – Drag…
- CVE-2025-22803WordPress Advanced Product Information for WooCommerce plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerabilityVillaTheme Advanced Product Information for WooCommerce
- CVE-2025-22804WordPress Author Avatars List/Block plugin <= 2.1.23 - Stored Cross Site Scripting (XSS) vulnerabilityPaul Bearne Author Avatars List/Block
- CVE-2025-22805WordPress Skill Bar Plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerabilityThemepoints Skill Bar
- CVE-2025-22806WordPress Black Widgets For Elementor plugin <= 1.3.8 - Cross Site Scripting (XSS) vulnerabilityModernaweb Studio Black Widgets For Elementor
- CVE-2025-22807WordPress Responsive Flickr Slideshow Plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerabilityRobert Responsive Flickr Slideshow
- CVE-2025-22808WordPress Surbma | Premium WP plugin <= 9.0 - Cross Site Scripting (XSS) vulnerabilitySurbma | Premium WP
- CVE-2025-22809WordPress PDF Catalog Woocommerce plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilitytheme funda PDF Catalog Woocommerce
- CVE-2025-22810WordPress Content Blocks Builder plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerabilityPhi Phan Content Blocks Builder
- CVE-2025-22811WordPress MT Addons for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityCristian Stan MT Addons for Elementor
- CVE-2025-22812WordPress News Ticker Widget for Elementor plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityAezaz Shaikh News Ticker Widget for Elementor
- CVE-2025-22813WordPress ChatBot Conversational Forms plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityQuantumCloud Conversational Forms for ChatBot
- CVE-2025-22815WordPress Button Block plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerabilitybPlugins Button Block
- CVE-2025-22817WordPress BP Profile Shortcodes Extra plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerabilityVenutius BP Profile Shortcodes Extra
- CVE-2025-22818WordPress S3Player plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerabilityS3Bubble S3Player – WooCommerce & Elementor Integration
- CVE-2025-22819WordPress Qr Code and Barcode Scanner Reader plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerabilityRoberto Bottalico Qr Code and Barcode Scanner Reader
- CVE-2025-22820WordPress VR Views plugin <= 1.5.1 - Stored Cross Site Scripting (XSS) vulnerabilitygoldsounds VR Views
- CVE-2025-22821WordPress StorePress theme <= 1.0.12 - Cross Site Scripting (XSS) vulnerabilityvfthemes StorePress
- CVE-2025-22822WordPress wp custom countdown Plugin <= 2.8 - Stored Cross Site Scripting (XSS) vulnerabilitybishawjit-das wp custom countdown
- CVE-2025-22823WordPress Genesis Style Shortcodes Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityjtwerdy Genesis Style Shortcodes
- CVE-2025-22824WordPress Live Flight Radar Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitylucia.intelisano Live Flight Radar
- CVE-2025-22826WordPress Sell Digital Downloads plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerabilitywpecommerce Sell Digital Downloads
- CVE-2025-22827WordPress WP Joomag plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerabilityWP Joomag
- CVE-2024-10106Ember ZNet buffer overflow in 'packet handoff' pluginsilabs.com Ember ZNet SDK
- CVE-2022-22491IBM App Connect Enterprise Certified Container denial of serviceIBM App Connect Enterprise Certified Container
- CVE-2024-43176IBM OpenPages information disclosureIBM OpenPages
- CVE-2024-6155Greenshift – animation and page builder blocks <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scriptingwpsoul Greenshift – animation and page builder blocks
- CVE-2024-125143DVieweronline <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting3dvieweronline 3D Viewer Online
- CVE-2024-12394Action Network <= 1.4.4 - Reflected Cross-Site Scriptingconcertedaction Action Network
- CVE-2024-12616Bitly's WordPress Plugin <= 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Updatebitlydeveloper Bitly's WordPress Plugin
- CVE-2024-12491SimplyRETS Real Estate IDX <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingreichertbrothers SimplyRETS Real Estate IDX
- CVE-2024-12515Muslim Prayer Time-Salah/Iqamah <= 1.8.11 - Authenticated (Contributor+) Stored Cross-Site Scriptingmasjidal Muslim Prayer Time-Salah/Iqamah
- CVE-2024-12819Searchie <= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingSearchie
- CVE-2024-11686WhatsApp click to chat <= 3.0.4 - Reflected Cross-Site Scriptingmanycontacts WhatsApp 🚀 click to chat
- CVE-2024-11815Pósturinn\'s Shipping with WooCommerce <= 1.3.1 - Reflected Cross-Site Scriptingposturinn Pósturinn\'s Shipping with WooCommerce
- CVE-2024-11907Skyword API Plugin <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingSkyword XMLRPC publishing
- CVE-2024-12621Yumpu E-Paper publishing <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingYumpu E-Paper publishing
- CVE-2024-11328CLUEVO LMS, E-Learning Platform <= 1.13.2 - Reflected Cross-Site ScriptingCLUEVO LMS, E-Learning Platform
- CVE-2024-12218Woocommerce check pincode/zipcode for shipping <= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scriptingphoeniixx Woocommerce check pincode/zipcode for shipping
- CVE-2024-11929Responsive FlipBook Plugin Wordpress <= 2.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scriptingmpc Responsive FlipBook Plugin Wordpress
- CVE-2024-12605AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Cross-Site Request Forgery to Settings Updateopacewebdesign Opace AI Scribe: SEO Content Creator & Humai…
- CVE-2024-12067WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 10.0.0 - Authenticated (Subscriber+) SQL Injectionwptravel WP Travel – Ultimate Travel Booking System, Tour M…
- CVE-2024-12206Wordpress Header Builder Plugin <= 1.3.8 - Cross-Site Request Forgery to Header Deletionstylemix Pearl – Header Builder
- CVE-2024-5769MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Limited Settings Updatesurakrai MIMO Woocommerce Order Tracking
- CVE-2024-12285SEMA API <= 5.27 - Reflected Cross-Site Scripting via catid Parameterssema SEMA API
- CVE-2024-12222Deliver via Shipos for WooCommerce <= 2.1.7 - Reflected Cross-Site Scripting via dvsfw_bulk_label_url Parameteramitrotem Deliver via Shipos for WooCommerce
- CVE-2024-12249GS Insever Portfolio <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injectionsamdani GS Insever Portfolio
- CVE-2024-12496Linear <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scriptinglinearoy Linear
- CVE-2024-12493Files Download Delay <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingblueberryacc Files Download Delay
- CVE-2024-12122ResAds <= 2.0.6 - Reflected Cross-Site Scripting via Multiple Parametersweb-mv ResAds
- CVE-2024-12618Newsletter2Go <= 4.0.14 - Missing Authorization to Authenticated (Subscriber+) Style ResetNewsletter2Go
- CVE-2025-0348CampCodes DepEd Equipment Inventory System add_employee.php cross site scriptingCampCodes DepEd Equipment Inventory System
- CVE-2025-0347code-projects Admission Management System Login index.php sql injectioncode-projects Admission Management System
- CVE-2025-0346code-projects Content Management System Publish News Page publishnews.php unrestricted uploadcode-projects Content Management System
- CVE-2025-0345leiyuxi cy-fast listData sql injectionleiyuxi cy-fast
- CVE-2024-13153Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetsunitecms Unlimited Elements For Elementor
- CVE-2025-0344leiyuxi cy-fast listData sql injectionleiyuxi cy-fast
- CVE-2024-43663Buffer overflow vulnerabilities in CGI scripts lead to segfaultIocharger firmware for AC models
- CVE-2024-43662Authenticated arbitrary file upload to /tmp/ and /tmp/upload/Iocharger firmware for AC models
- CVE-2025-0342CampCodes Computer Laboratory Management System edit cross site scriptingCampCodes Computer Laboratory Management System
- CVE-2025-0341CampCodes Computer Laboratory Management System edit unrestricted uploadCampCodes Computer Laboratory Management System
- CVE-2024-12806A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file.SonicWall SonicOS
- CVE-2025-0340code-projects Cinema Seat Reservation System deleteBooking.php sql injectioncode-projects Cinema Seat Reservation System
- CVE-2025-0339code-projects Online Bike Rental HTTP GET Request vehical-details.php cross site scriptingcode-projects Online Bike Rental
- CVE-2025-22445Misleading UI for undefined admin console settings in Calls causes security confusionMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2025-20033DoS via custom post type for sysconsole plugin readersMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-22449Access control flaw for team admins allows unauthorized team additionsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-13041Incorrect User Management in GitLabGitLab
- CVE-2025-0336Codezips Project Management System teacher.php sql injectionCodezips Project Management System
- CVE-2024-6324Inefficient Algorithmic Complexity in GitLabGitLab
- CVE-2025-0335code-projects Online Bike Rental System Change Image unrestricted uploadcode-projects Online Bike Rental System
- CVE-2024-12736BU Section Editing <= 0.9.9 - Reflected XSSBU Section Editing
- CVE-2024-12731aklamator-infeed <= 2.0.0 - Reflected XSSAklamator INfeed
- CVE-2025-0334leiyuxi cy-fast listData sql injectionleiyuxi cy-fast
- CVE-2024-12717aklamator-infeed <= 2.0.0 - Admin+ Stored XSSAklamator INfeed
- CVE-2024-12715Asgard Security Scanner <= 0.7 - Reflected XSSAsgard Security Scanner
- CVE-2024-12714Backlink Monitoring Manager <= 0.1.3 - Reflected XSSBacklink Monitoring Manager
- CVE-2024-10815PostLists <= 2.0.2 - Reflected XSSPostLists
- CVE-2025-0333leiyuxi cy-fast listData sql injectionleiyuxi cy-fast
- CVE-2025-0331YunzMall HTTP POST Request ResetpwdController.php changePwd password recoveryYunzMall
- CVE-2025-0328KaiYuanTong ECT Platform HTTP POST Request runCode.php command injectionKaiYuanTong ECT Platform
- CVE-2024-13213SingMR HouseRent toAdminUpdateHousePage cross site scriptingSingMR HouseRent
- CVE-2024-13212SingMR HouseRent AddHouseController.java upload unrestricted uploadSingMR HouseRent
- CVE-2024-56827Openjpeg: heap buffer overflow in lib/openjp2/j2k.copenjpeg · Red Hat Enterprise Linux
- CVE-2024-56826Openjpeg: heap buffer overflow in bin/common/color.copenjpeg · Red Hat Enterprise Linux
- CVE-2024-13211SingMR HouseRent AdminController.java access controlSingMR HouseRent
- CVE-2024-13210donglight bookstore电商书城系统说明 AdminBookController. java uploadPicture unrestricted uploaddonglight bookstore电商书城系统说明
- CVE-2024-13209Redaxo CMS Structure Management Page index.php cross site scriptingRedaxo CMS · redaxo/source
- CVE-2024-13205kurniaramadhan E-Commerce-PHP Create Product Page create_product.php cross site scriptingkurniaramadhan E-Commerce-PHP
- CVE-2024-13204kurniaramadhan E-Commerce-PHP blog-details.php sql injectionkurniaramadhan E-Commerce-PHP
- CVE-2024-13203kurniaramadhan E-Commerce-PHP cross-site request forgerykurniaramadhan E-Commerce-PHP
- CVE-2024-13202wander-chu SpringBoot-Blog Blog Article PageController.java modifiyArticle cross site scriptingwander-chu SpringBoot-Blog
- CVE-2024-13201wander-chu SpringBoot-Blog Admin Attachment AttachtController.java upload unrestricted uploadwander-chu SpringBoot-Blog
- CVE-2024-13200wander-chu SpringBoot-Blog HTTP POST Request BaseInterceptor.java preHandle access controlwander-chu SpringBoot-Blog
- CVE-2023-23913There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are asrails-ujs · actionview
- CVE-2023-27531There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization codeRails Kredis JSON · kredis
- CVE-2023-27539There is a denial of service vulnerability in the header parsing component of Rack.Rails Rack · rack
- CVE-2023-28362The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value.Rails Action Pack · actionpack
- CVE-2023-38037ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file.Rails ActiveSupport · activesupport
- CVE-2024-37372The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not alwNodeJS Node
- CVE-2023-28120There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.Rails ActiveSupport · activesupport
- CVE-2024-13199langhsu Mblog Blog System Search Bar search cross site scriptinglanghsu Mblog Blog System
- CVE-2024-13198langhsu Mblog Blog System login observable response discrepancylanghsu Mblog Blog System
- CVE-2024-13197donglight bookstore电商书城系统说明 AdminUserControlle.java updateUser cross site scriptingdonglight bookstore电商书城系统说明
- CVE-2024-13196donglight bookstore电商书城系统说明 BookInfoController.java BookSearchList cross site scriptingdonglight bookstore电商书城系统说明
- CVE-2024-42898A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted p
- CVE-2024-48806Buffer Overflow vulnerability in Neat Board NFC v.1.20240620.0015 allows a physically proximate attackers to escalate privileges via a craft
- CVE-2024-54761BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter.
- CVE-2024-54762Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability.
- CVE-2024-55226Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/corvaultwarden
- CVE-2024-55494A PHP Code Injection vulnerability that can lead to Remote Code Execution (RCE) and XSS in Opencode Mobile Collect Call v5.4.7 allows attack
- CVE-2024-56114Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result
- CVE-2024-56376A stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6 allows authenticated users to inject malicious Vanderbilt REDCap
- CVE-2024-56377A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts iVanderbilt REDCap