# CVEs published 2025-01-09

267 CVEs were published on January 9, 2025: 36 critical, 62 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-21380](https://cve.now/CVE-2025-21380.md): Azure Marketplace SaaS Resources Information Disclosure Vulnerability (CVSS 8.8, Microsoft Marketplace SaaS)
- [CVE-2025-21385](https://cve.now/CVE-2025-21385.md): Microsoft Purview Information Disclosure Vulnerability (CVSS 8.8, Microsoft Purview)
- [CVE-2024-13312](https://cve.now/CVE-2024-13312.md): Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076 (CVSS 5.3, Drupal Open Social)
- [CVE-2024-13311](https://cve.now/CVE-2024-13311.md): Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075 (CVSS 7.3, Drupal Allow All File Extensions for file fields · drupal/a…)
- [CVE-2024-13310](https://cve.now/CVE-2024-13310.md): Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074 (CVSS 6.5, Git Utilities for Drupal · drupal/git\_utils)
- [CVE-2024-13309](https://cve.now/CVE-2024-13309.md): Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073 (CVSS 5.4, Drupal Login Disable · drupal/login\_disable)
- [CVE-2024-13308](https://cve.now/CVE-2024-13308.md): Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072 (CVSS 3.8, Drupal Browser Back Button · drupal/browser\_back\_button)
- [CVE-2024-13305](https://cve.now/CVE-2024-13305.md): Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071 (CVSS 4.8, Drupal Entity Form Steps · drupal/entity\_form\_steps)
- [CVE-2024-13304](https://cve.now/CVE-2024-13304.md): Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070 (CVSS 4.5, Drupal Minify JS · drupal/minifyjs)
- [CVE-2024-13303](https://cve.now/CVE-2024-13303.md): Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069 (CVSS 5.3, Drupal Download All Files · drupal/download\_all\_files)
- [CVE-2024-13302](https://cve.now/CVE-2024-13302.md): Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068 (CVSS 5.3, Drupal Pages Restriction Access · drupal/pages\_restriction)
- [CVE-2024-13301](https://cve.now/CVE-2024-13301.md): OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067 (CVSS 6.1, Drupal OAuth & OpenID Connect Single Sign On – SSO · drupal…)
- [CVE-2024-13300](https://cve.now/CVE-2024-13300.md): Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066 (CVSS 6.6, Drupal Print Anything)
- [CVE-2024-13299](https://cve.now/CVE-2024-13299.md): Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065 (CVSS 6.6, Drupal Megamenu Framework)
- [CVE-2024-13298](https://cve.now/CVE-2024-13298.md): Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064 (CVSS 4.8, Drupal Tarte au Citron · drupal/tarte\_au\_citron)
- [CVE-2024-13297](https://cve.now/CVE-2024-13297.md): Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063 (CVSS 6.6, Drupal Eloqua)
- [CVE-2024-13296](https://cve.now/CVE-2024-13296.md): Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062 (CVSS 6.6, Drupal Mailjet · drupal/mailjet)
- [CVE-2024-13295](https://cve.now/CVE-2024-13295.md): Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061 (CVSS 6.6, Drupal Node export)
- [CVE-2024-13294](https://cve.now/CVE-2024-13294.md): POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060 (CVSS 5.4, Drupal POST File · drupal/postfile)
- [CVE-2024-13293](https://cve.now/CVE-2024-13293.md): POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059 (CVSS 3.1, Drupal POST File · drupal/postfile)
- [CVE-2024-13292](https://cve.now/CVE-2024-13292.md): Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058 (CVSS 4.8, Drupal Tooltip · drupal/tooltip)
- [CVE-2024-13291](https://cve.now/CVE-2024-13291.md): Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057 (CVSS 7.3, Drupal Basic HTTP Authentication)
- [CVE-2024-13290](https://cve.now/CVE-2024-13290.md): OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056 (CVSS 5.3, Drupal OhDear Integration · drupal/ohdear\_integration)
- [CVE-2024-13289](https://cve.now/CVE-2024-13289.md): Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055 (CVSS 5.4, Drupal Cookiebot + GTM · drupal/cookiebot\_gtm)
- [CVE-2024-13288](https://cve.now/CVE-2024-13288.md): Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052 (CVSS 4.3, Drupal Monster Menus · drupal/monster\_menus)
- [CVE-2024-13287](https://cve.now/CVE-2024-13287.md): Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051 (CVSS 5.4, Drupal Views SVG Animation · drupal/views\_svg\_animation)
- [CVE-2024-13286](https://cve.now/CVE-2024-13286.md): SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050 (CVSS 5.4, Drupal SVG Embed · drupal/svg\_embed)
- [CVE-2024-13285](https://cve.now/CVE-2024-13285.md): wkhtmltopdf - Highly critical - Unsupported - SA-CONTRIB-2024-049 (CVSS 9.8, Drupal wkhtmltopdf · drupal/wkhtmltopdf)
- [CVE-2024-13284](https://cve.now/CVE-2024-13284.md): Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048 (CVSS 8.8, Drupal Gutenberg · drupal/gutenberg)
- [CVE-2024-13283](https://cve.now/CVE-2024-13283.md): Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047 (CVSS 6.1, Drupal Facets · drupal/facets)
- [CVE-2024-13282](https://cve.now/CVE-2024-13282.md): Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046 (CVSS 8.8, Drupal Block permissions · drupal/block\_permissions)
- [CVE-2024-13281](https://cve.now/CVE-2024-13281.md): Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045 (CVSS 9.1, Drupal Monster Menus · drupal/monster\_menus)
- [CVE-2024-13280](https://cve.now/CVE-2024-13280.md): Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044 (CVSS 9.8, Drupal Persistent Login · drupal/persistent\_login)
- [CVE-2024-13279](https://cve.now/CVE-2024-13279.md): Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043 (CVSS 9.8, Drupal Two-factor Authentication · drupal/tfa)
- [CVE-2024-13278](https://cve.now/CVE-2024-13278.md): Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042 (CVSS 9.1, Drupal Diff · drupal/diff)
- [CVE-2024-13277](https://cve.now/CVE-2024-13277.md): Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041 (CVSS 9.1, Drupal Smart IP Ban)
- [CVE-2024-13276](https://cve.now/CVE-2024-13276.md): File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040 (CVSS 7.5, Drupal File Entity)
- [CVE-2024-13275](https://cve.now/CVE-2024-13275.md): Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039 (CVSS 5.3, Drupal Security Kit · drupal/seckit)
- [CVE-2024-13274](https://cve.now/CVE-2024-13274.md): Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038 (CVSS 5.3, Drupal Open Social · goalgorilla/open\_social)
- [CVE-2024-13273](https://cve.now/CVE-2024-13273.md): Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037 (CVSS 5.4, Drupal Open Social)
- [CVE-2024-10215](https://cve.now/CVE-2024-10215.md): WPBookit \<= 1.6.4 - Unauthenticated Arbitrary User Password Change (CVSS 9.8, Iqonic Design WPBookit)
- [CVE-2024-13272](https://cve.now/CVE-2024-13272.md): Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036 (CVSS 6.3, Drupal Paragraphs table · drupal/paragraphs\_table)
- [CVE-2024-13271](https://cve.now/CVE-2024-13271.md): Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035 (CVSS 4.3, Drupal Content Entity Clone · drupal/content\_entity\_clone)
- [CVE-2024-13270](https://cve.now/CVE-2024-13270.md): Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034 (CVSS 4.3, Drupal Freelinking · drupal/freelinking)
- [CVE-2024-13269](https://cve.now/CVE-2024-13269.md): Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033 (CVSS 5.3, Drupal Advanced Varnish · drupal/adv\_varnish)
- [CVE-2024-13268](https://cve.now/CVE-2024-13268.md): Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032 (CVSS 6.8, Drupal Opigno)
- [CVE-2024-13267](https://cve.now/CVE-2024-13267.md): Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031 (CVSS 7.5, Drupal Opigno TinCan Question Type)
- [CVE-2024-13266](https://cve.now/CVE-2024-13266.md): Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030 (CVSS 5.3, Drupal Responsive and off-canvas menu · drupal/responsive\_m…)
- [CVE-2024-13265](https://cve.now/CVE-2024-13265.md): Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029 (CVSS 7.5, Drupal Opigno Learning path · drupal/opigno\_learning\_path)
- [CVE-2024-13264](https://cve.now/CVE-2024-13264.md): Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028 (CVSS 9.8, Drupal Opigno module · drupal/opigno\_module)
- [CVE-2024-13263](https://cve.now/CVE-2024-13263.md): Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027 (CVSS 5.5, Drupal Opigno group manager · drupal/opigno\_group\_manager)
- [CVE-2024-13262](https://cve.now/CVE-2024-13262.md): View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026 (CVSS 4.8, Drupal View Password · drupal/view\_password)
- [CVE-2024-13261](https://cve.now/CVE-2024-13261.md): Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025 (CVSS 3.5, Drupal Acquia DAM · drupal/acquia\_dam)
- [CVE-2024-13260](https://cve.now/CVE-2024-13260.md): Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024 (CVSS 8.8, Drupal Migrate queue importer · drupal/migrate\_queue\_import…)
- [CVE-2024-13259](https://cve.now/CVE-2024-13259.md): Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023 (CVSS 7.5, Drupal Image Sizes · drupal/image\_sizes)
- [CVE-2024-13258](https://cve.now/CVE-2024-13258.md): Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022 (CVSS 9.8, Drupal REST & JSON API Authentication · drupal/rest\_api\_aut…)
- [CVE-2024-13257](https://cve.now/CVE-2024-13257.md): Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021 (CVSS 5.3, Drupal Commerce View Receipt · drupal/commerce\_view\_receipt)
- [CVE-2024-13256](https://cve.now/CVE-2024-13256.md): Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020 (CVSS 7.5, Drupal Email Contact · drupal/email\_contact)
- [CVE-2024-13255](https://cve.now/CVE-2024-13255.md): RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019 (CVSS 7.5, Drupal RESTful Web Services)
- [CVE-2024-13254](https://cve.now/CVE-2024-13254.md): REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018 (CVSS 7.5, Drupal REST Views · drupal/rest\_views)
- [CVE-2024-13253](https://cve.now/CVE-2024-13253.md): Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017 (CVSS 9.1, Drupal Advanced PWA inc Push Notifications · drupal/advance…)
- [CVE-2024-13252](https://cve.now/CVE-2024-13252.md): TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016 (CVSS 5.4, Drupal TacJS · drupal/tacjs)
- [CVE-2024-13251](https://cve.now/CVE-2024-13251.md): Registration role - Critical - Access bypass - SA-CONTRIB-2024-015 (CVSS 8.8, Drupal Registration role · drupal/registration\_role)
- [CVE-2024-13250](https://cve.now/CVE-2024-13250.md): Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014 (CVSS 8.8, Drupal Symfony Mailer Lite · drupal/symfony\_mailer\_lite)
- [CVE-2024-13249](https://cve.now/CVE-2024-13249.md): Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013 (CVSS 5.4, Drupal Node Access Rebuild Progressive)
- [CVE-2024-13248](https://cve.now/CVE-2024-13248.md): Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012 (CVSS 5.5, Drupal Private content · drupal/private\_content)
- [CVE-2024-13247](https://cve.now/CVE-2024-13247.md): Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011 (CVSS 4.8, Drupal Coffee · drupal/coffee)
- [CVE-2024-13246](https://cve.now/CVE-2024-13246.md): Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010 (CVSS 5.3, Drupal Node Access Rebuild Progressive · drupal/node\_access…)
- [CVE-2025-22151](https://cve.now/CVE-2025-22151.md): Strawberry GraphQL has a type resolution vulnerability (CVSS 3.7, strawberry-graphql strawberry · strawberry-graphql)
- [CVE-2024-13245](https://cve.now/CVE-2024-13245.md): CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009 (CVSS 5.4, Drupal CKEditor 4 LTS - WYSIWYG HTML editor · drupal/ckedit…)
- [CVE-2024-13244](https://cve.now/CVE-2024-13244.md): Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008 (CVSS 8.8, Drupal Migrate Tools · drupal/migrate\_tools)
- [CVE-2024-13243](https://cve.now/CVE-2024-13243.md): Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007 (CVSS 6.5, Drupal Entity Delete Log · drupal/entity\_delete\_log)
- [CVE-2024-13242](https://cve.now/CVE-2024-13242.md): Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006 (CVSS 9.1, Drupal Swift Mailer · drupal/swiftmailer)
- [CVE-2024-13241](https://cve.now/CVE-2024-13241.md): Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005 (CVSS 9.1, Drupal Open Social)
- [CVE-2024-13240](https://cve.now/CVE-2024-13240.md): Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004 (CVSS 7.5, Drupal Open Social)
- [CVE-2024-13239](https://cve.now/CVE-2024-13239.md): Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003 (CVSS 9.8, Drupal Two-factor Authentication · drupal/tfa)
- [CVE-2024-13238](https://cve.now/CVE-2024-13238.md): Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002 (CVSS 5.4, Drupal Typogrify · drupal/typogrify)
- [CVE-2025-21598](https://cve.now/CVE-2025-21598.md): Junos OS and Junos OS Evolved: When BGP traceoptions are configured, receipt of malformed BGP packets causes RPD to crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-13237](https://cve.now/CVE-2024-13237.md): File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001 (CVSS 5.4, Drupal File Entity)
- [CVE-2025-22149](https://cve.now/CVE-2025-22149.md): JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh (CVSS 2.1, MicahParks jwkset · github.com/MicahParks/jwkset)
- [CVE-2025-21628](https://cve.now/CVE-2025-21628.md): Chatwoot has a Blind SQL-injection in Conversation and Contacts filters (CVSS 9.1, chatwoot)
- [CVE-2025-21600](https://cve.now/CVE-2025-21600.md): Junos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2025-21602](https://cve.now/CVE-2025-21602.md): Junos OS and Junos OS Evolved: Receipt of specially crafted BGP update packet causes RPD crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2025-21599](https://cve.now/CVE-2025-21599.md): Junos OS Evolved: Receipt of specifically malformed IPv6 packets causes kernel memory exhaustion leading to Denial of Service (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2025-21596](https://cve.now/CVE-2025-21596.md): Junos OS: SRX1500,SRX4100,SRX4200: Execution of low-privileged CLI command results in chassisd crash (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2025-21593](https://cve.now/CVE-2025-21593.md): Junos OS and Junos OS Evolved: On SRv6 enabled devices, an attacker sending a malformed BGP update can cause the rpd to crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2025-21592](https://cve.now/CVE-2025-21592.md): Junos OS: SRX Series: Low privileged user able to access highly sensitive information on file system (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2025-22295](https://cve.now/CVE-2025-22295.md): WordPress Tripetto plugin \<= 8.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WordPress form builder plugin for contact forms, surveys an…)
- [CVE-2025-22307](https://cve.now/CVE-2025-22307.md): WordPress Product Table for WooCommerce plugin \<= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Saiful Islam Product Table for WooCommerce)
- [CVE-2025-22313](https://cve.now/CVE-2025-22313.md): WordPress Widgetize Pages Light plugin \<= 3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, OTWthemes Widgetize Pages Light)
- [CVE-2025-22330](https://cve.now/CVE-2025-22330.md): WordPress MG Parallax Slider plugin \<= 1.0. - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mahesh Waghmare MG Parallax Slider)
- [CVE-2025-22331](https://cve.now/CVE-2025-22331.md): WordPress Cf7Save Extension plugin \<= 1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, P3JX Cf7Save Extension)
- [CVE-2025-22345](https://cve.now/CVE-2025-22345.md): WordPress TS Comfort DB plugin \<= 2.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tsinf TS Comfort DB)
- [CVE-2025-22361](https://cve.now/CVE-2025-22361.md): WordPress Opentracker Analytics Plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Opentracker Analytics)
- [CVE-2025-22504](https://cve.now/CVE-2025-22504.md): WordPress 4ECPS Web Forms Plugin \<= 0.2.18 - Arbitrary File Upload vulnerability (CVSS 10.0, jumpdemand 4ECPS Web Forms)
- [CVE-2025-22505](https://cve.now/CVE-2025-22505.md): WordPress NC Wishlist for Woocommerce Plugin \<= 1.0.1 - SQL Injection vulnerability (CVSS 8.5, Crispweb NC Wishlist for Woocommerce)
- [CVE-2025-22508](https://cve.now/CVE-2025-22508.md): WordPress FAT Event Lite plugin \<= 1.1 - Unauthenticated Non-Arbitrary Local File Inclusion vulnerability (CVSS 8.1, roninwp FAT Event Lite)
- [CVE-2025-22510](https://cve.now/CVE-2025-22510.md): WordPress WC Price History for Omnibus plugin \<= 2.1.4 - PHP Object Injection vulnerability (CVSS 7.2, kkarpieszuk WC Price History for Omnibus)
- [CVE-2025-22521](https://cve.now/CVE-2025-22521.md): WordPress wp Hosting Performance Check Plugin \<= 2.18.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Scott Farrell wp Hosting Performance Check)
- [CVE-2025-22527](https://cve.now/CVE-2025-22527.md): WordPress Mailing Group Listserv Plugin \<= 2.0.9 - SQL Injection vulnerability (CVSS 7.6, Yamna Khawaja Mailing Group Listserv)
- [CVE-2025-22535](https://cve.now/CVE-2025-22535.md): WordPress WPListCal Plugin \<= 1.3.5 - SQL Injection vulnerability (CVSS 8.5, jonkern WPListCal)
- [CVE-2025-22537](https://cve.now/CVE-2025-22537.md): WordPress Google Maps Travel Route Plugin \<= 1.3.1 - SQL Injection vulnerability (CVSS 8.5, traveller11 Google Maps Travel Route)
- [CVE-2025-22539](https://cve.now/CVE-2025-22539.md): WordPress Custom DataBase Tables Plugin \<= 2.1.34 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ka2 Custom DataBase Tables)
- [CVE-2025-22540](https://cve.now/CVE-2025-22540.md): WordPress Emailing Subscription Plugin \<= 1.4.1 - SQL Injection vulnerability (CVSS 9.3, seballero Emailing Subscription)
- [CVE-2025-22542](https://cve.now/CVE-2025-22542.md): WordPress Virtual Bot Plugin \<= 1.0.0 - SQL Injection vulnerability (CVSS 9.3, Ofek Nakar Virtual Bot)
- [CVE-2025-22561](https://cve.now/CVE-2025-22561.md): WordPress Title Experiments Free plugin \<= 9.0.4 - Broken Access Control vulnerability (CVSS 4.3, kbowson Title Experiments Free)
- [CVE-2025-22594](https://cve.now/CVE-2025-22594.md): WordPress Better User Shortcodes Plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, hccoder Better User Shortcodes)
- [CVE-2025-22595](https://cve.now/CVE-2025-22595.md): WordPress Mailing Group Listserv Plugin \<= 2.0.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Yamna Khawaja Mailing Group Listserv)
- [CVE-2025-22801](https://cve.now/CVE-2025-22801.md): WordPress Free WooCommerce Theme 99fy Extension plugin \<= 1.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HasThemes Free WooCommerce Theme 99fy Extension)
- [CVE-2025-22802](https://cve.now/CVE-2025-22802.md): WordPress Email Templates Customizer YeeMail plugin \<= 2.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, add-ons.org Email Templates Customizer for WordPress – Drag…)
- [CVE-2025-22803](https://cve.now/CVE-2025-22803.md): WordPress Advanced Product Information for WooCommerce plugin \<= 1.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, VillaTheme Advanced Product Information for WooCommerce)
- [CVE-2025-22804](https://cve.now/CVE-2025-22804.md): WordPress Author Avatars List/Block plugin \<= 2.1.23 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Paul Bearne Author Avatars List/Block)
- [CVE-2025-22805](https://cve.now/CVE-2025-22805.md): WordPress Skill Bar Plugin \<= 1.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themepoints Skill Bar)
- [CVE-2025-22806](https://cve.now/CVE-2025-22806.md): WordPress Black Widgets For Elementor plugin \<= 1.3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Modernaweb Studio Black Widgets For Elementor)
- [CVE-2025-22807](https://cve.now/CVE-2025-22807.md): WordPress Responsive Flickr Slideshow Plugin \<= 2.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Robert Responsive Flickr Slideshow)
- [CVE-2025-22808](https://cve.now/CVE-2025-22808.md): WordPress Surbma | Premium WP plugin \<= 9.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Surbma | Premium WP)
- [CVE-2025-22809](https://cve.now/CVE-2025-22809.md): WordPress PDF Catalog Woocommerce plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, theme funda PDF Catalog Woocommerce)
- [CVE-2025-22810](https://cve.now/CVE-2025-22810.md): WordPress Content Blocks Builder plugin \<= 2.7.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Phi Phan Content Blocks Builder)
- [CVE-2025-22811](https://cve.now/CVE-2025-22811.md): WordPress MT Addons for Elementor plugin \<= 1.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Cristian Stan MT Addons for Elementor)
- [CVE-2025-22812](https://cve.now/CVE-2025-22812.md): WordPress News Ticker Widget for Elementor plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aezaz Shaikh News Ticker Widget for Elementor)
- [CVE-2025-22813](https://cve.now/CVE-2025-22813.md): WordPress ChatBot Conversational Forms plugin \<= 1.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, QuantumCloud Conversational Forms for ChatBot)
- [CVE-2025-22814](https://cve.now/CVE-2025-22814.md): WordPress Zephyr Admin Theme Plugin \<= 1.4.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Dylan James Zephyr Admin Theme)
- [CVE-2025-22815](https://cve.now/CVE-2025-22815.md): WordPress Button Block plugin \<= 1.1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Button Block)
- [CVE-2025-22817](https://cve.now/CVE-2025-22817.md): WordPress BP Profile Shortcodes Extra plugin \<= 2.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Venutius BP Profile Shortcodes Extra)
- [CVE-2025-22818](https://cve.now/CVE-2025-22818.md): WordPress S3Player plugin \<= 4.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, S3Bubble S3Player – WooCommerce & Elementor Integration)
- [CVE-2025-22819](https://cve.now/CVE-2025-22819.md): WordPress Qr Code and Barcode Scanner Reader plugin \<= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Roberto Bottalico Qr Code and Barcode Scanner Reader)
- [CVE-2025-22820](https://cve.now/CVE-2025-22820.md): WordPress VR Views plugin \<= 1.5.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, goldsounds VR Views)
- [CVE-2025-22821](https://cve.now/CVE-2025-22821.md): WordPress StorePress theme \<= 1.0.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, vfthemes StorePress)
- [CVE-2025-22822](https://cve.now/CVE-2025-22822.md): WordPress wp custom countdown Plugin \<= 2.8 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bishawjit-das wp custom countdown)
- [CVE-2025-22823](https://cve.now/CVE-2025-22823.md): WordPress Genesis Style Shortcodes Plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jtwerdy Genesis Style Shortcodes)
- [CVE-2025-22824](https://cve.now/CVE-2025-22824.md): WordPress Live Flight Radar Plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, lucia.intelisano Live Flight Radar)
- [CVE-2025-22826](https://cve.now/CVE-2025-22826.md): WordPress Sell Digital Downloads plugin \<= 2.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpecommerce Sell Digital Downloads)
- [CVE-2025-22827](https://cve.now/CVE-2025-22827.md): WordPress WP Joomag plugin \<= 2.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Joomag)
- [CVE-2024-10106](https://cve.now/CVE-2024-10106.md): Ember ZNet buffer overflow in 'packet handoff' plugin (CVSS 3.7, silabs.com Ember ZNet SDK)
- [CVE-2023-24012](https://cve.now/CVE-2023-24012.md): Data Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Open DDS (CVSS 8.2, OpenDDS DDS)
- [CVE-2023-24011](https://cve.now/CVE-2023-24011.md): Data Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Cyclone DDS (CVSS 8.2, ZettaScale DDS)
- [CVE-2023-24010](https://cve.now/CVE-2023-24010.md): Data Distribution Service (DDS) Chain of Trust (CoT) violation in Fast DDS (CVSS 8.2, eProsima DDS)
- [CVE-2022-22491](https://cve.now/CVE-2022-22491.md): IBM App Connect Enterprise Certified Container denial of service (CVSS 5.5, IBM App Connect Enterprise Certified Container)
- [CVE-2024-43176](https://cve.now/CVE-2024-43176.md): IBM OpenPages information disclosure (CVSS 5.4, IBM OpenPages)
- [CVE-2024-6155](https://cve.now/CVE-2024-6155.md): Greenshift – animation and page builder blocks \<= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting (CVSS 6.4, wpsoul Greenshift – animation and page builder blocks)
- [CVE-2024-12514](https://cve.now/CVE-2024-12514.md): 3DVieweronline \<= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, 3dvieweronline 3D Viewer Online)
- [CVE-2024-12394](https://cve.now/CVE-2024-12394.md): Action Network \<= 1.4.4 - Reflected Cross-Site Scripting (CVSS 6.1, concertedaction Action Network)
- [CVE-2024-12542](https://cve.now/CVE-2024-12542.md): linkID \<= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 8.6, linkID)
- [CVE-2024-11642](https://cve.now/CVE-2024-11642.md): Post Grid Master \<= 3.4.12 - Missing Authorization to Unauthenticated Local PHP File Inclusion (CVSS 9.8, mdshuvo Post Grid Master — Post Grids & AJAX Filters)
- [CVE-2024-12616](https://cve.now/CVE-2024-12616.md): Bitly's WordPress Plugin \<= 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, bitlydeveloper Bitly's WordPress Plugin)
- [CVE-2024-12491](https://cve.now/CVE-2024-12491.md): SimplyRETS Real Estate IDX \<= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, reichertbrothers SimplyRETS Real Estate IDX)
- [CVE-2024-12515](https://cve.now/CVE-2024-12515.md): Muslim Prayer Time-Salah/Iqamah \<= 1.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, masjidal Muslim Prayer Time-Salah/Iqamah)
- [CVE-2024-12819](https://cve.now/CVE-2024-12819.md): Searchie \<= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Searchie)
- [CVE-2024-12848](https://cve.now/CVE-2024-12848.md): SKT Page Builder \<= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, sonalsinha21 SKT Page Builder)
- [CVE-2024-11686](https://cve.now/CVE-2024-11686.md): WhatsApp click to chat \<= 3.0.4 - Reflected Cross-Site Scripting (CVSS 6.1, manycontacts WhatsApp 🚀 click to chat)
- [CVE-2024-11815](https://cve.now/CVE-2024-11815.md): Pósturinn\\'s Shipping with WooCommerce \<= 1.3.1 - Reflected Cross-Site Scripting (CVSS 6.1, posturinn Pósturinn\\'s Shipping with WooCommerce)
- [CVE-2024-11907](https://cve.now/CVE-2024-11907.md): Skyword API Plugin \<= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Skyword XMLRPC publishing)
- [CVE-2024-12621](https://cve.now/CVE-2024-12621.md): Yumpu E-Paper publishing \<= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Yumpu E-Paper publishing)
- [CVE-2024-11328](https://cve.now/CVE-2024-11328.md): CLUEVO LMS, E-Learning Platform \<= 1.13.2 - Reflected Cross-Site Scripting (CVSS 6.1, CLUEVO LMS, E-Learning Platform)
- [CVE-2024-12218](https://cve.now/CVE-2024-12218.md): Woocommerce check pincode/zipcode for shipping \<= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1, phoeniixx Woocommerce check pincode/zipcode for shipping)
- [CVE-2024-11929](https://cve.now/CVE-2024-11929.md): Responsive FlipBook Plugin Wordpress \<= 2.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, mpc Responsive FlipBook Plugin Wordpress)
- [CVE-2024-12605](https://cve.now/CVE-2024-12605.md): AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) \<= 2.5 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, opacewebdesign Opace AI Scribe: SEO Content Creator & Humai…)
- [CVE-2024-12067](https://cve.now/CVE-2024-12067.md): WP Travel – Ultimate Travel Booking System, Tour Management Engine \<= 10.0.0 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, wptravel WP Travel – Ultimate Travel Booking System, Tour M…)
- [CVE-2024-12206](https://cve.now/CVE-2024-12206.md): Wordpress Header Builder Plugin \<= 1.3.8 - Cross-Site Request Forgery to Header Deletion (CVSS 4.3, stylemix Pearl – Header Builder)
- [CVE-2024-5769](https://cve.now/CVE-2024-5769.md): MIMO Woocommerce Order Tracking \<= 1.0.2 - Missing Authorization to Limited Settings Update (CVSS 4.3, surakrai MIMO Woocommerce Order Tracking)
- [CVE-2024-12285](https://cve.now/CVE-2024-12285.md): SEMA API \<= 5.27 - Reflected Cross-Site Scripting via catid Parameter (CVSS 6.1, ssema SEMA API)
- [CVE-2024-12330](https://cve.now/CVE-2024-12330.md): WP Database Backup – Unlimited Database & Files Backup by Backup for WP \<= 7.3 - Unauthenticated Database Back-Up Exposure (CVSS 7.5, databasebackup WP Database Backup – Unlimited Database & Fi…)
- [CVE-2024-12222](https://cve.now/CVE-2024-12222.md): Deliver via Shipos for WooCommerce \<= 2.1.7 - Reflected Cross-Site Scripting via dvsfw\_bulk\_label\_url Parameter (CVSS 6.1, amitrotem Deliver via Shipos for WooCommerce)
- [CVE-2024-12249](https://cve.now/CVE-2024-12249.md): GS Insever Portfolio \<= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injection (CVSS 4.3, samdani GS Insever Portfolio)
- [CVE-2024-12496](https://cve.now/CVE-2024-12496.md): Linear \<= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, linearoy Linear)
- [CVE-2024-12493](https://cve.now/CVE-2024-12493.md): Files Download Delay \<= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, blueberryacc Files Download Delay)
- [CVE-2024-12122](https://cve.now/CVE-2024-12122.md): ResAds \<= 2.0.6 - Reflected Cross-Site Scripting via Multiple Parameters (CVSS 6.1, web-mv ResAds)
- [CVE-2024-12618](https://cve.now/CVE-2024-12618.md): Newsletter2Go \<= 4.0.14 - Missing Authorization to Authenticated (Subscriber+) Style Reset (CVSS 4.3, Newsletter2Go)
- [CVE-2025-0349](https://cve.now/CVE-2025-0349.md): Tenda AC6 GetParentControlInfo stack-based overflow (CVSS 8.7, Tenda AC6)
- [CVE-2025-0348](https://cve.now/CVE-2025-0348.md): CampCodes DepEd Equipment Inventory System add\_employee.php cross site scripting (CVSS 5.3, CampCodes DepEd Equipment Inventory System)
- [CVE-2025-0347](https://cve.now/CVE-2025-0347.md): code-projects Admission Management System Login index.php sql injection (CVSS 6.9, code-projects Admission Management System)
- [CVE-2024-12802](https://cve.now/CVE-2024-12802.md): SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Secur (CVSS 9.1, SonicWall SonicOS)
- [CVE-2025-0346](https://cve.now/CVE-2025-0346.md): code-projects Content Management System Publish News Page publishnews.php unrestricted upload (CVSS 5.1, code-projects Content Management System)
- [CVE-2025-0345](https://cve.now/CVE-2025-0345.md): leiyuxi cy-fast listData sql injection (CVSS 5.3, leiyuxi cy-fast)
- [CVE-2024-13153](https://cve.now/CVE-2024-13153.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, unitecms Unlimited Elements For Elementor)
- [CVE-2025-0344](https://cve.now/CVE-2025-0344.md): leiyuxi cy-fast listData sql injection (CVSS 5.3, leiyuxi cy-fast)
- [CVE-2024-43651](https://cve.now/CVE-2024-43651.md): Authenticated command injection in the \<redacted\> action leads to full remote code execution as root on the charging station (CVSS 9.3, Iocharger firmware for AC models)
- [CVE-2024-43658](https://cve.now/CVE-2024-43658.md): Using the \<redacted\> action or \<redacted\>.sh script, arbitrary files and directories can be deleted using directory traversal. (CVSS 7.2, Iocharger firmware for AC models)
- [CVE-2024-43654](https://cve.now/CVE-2024-43654.md): Authenticated command injection in the \<redacted\> action leads to full remote code execution as root on the charging station (CVSS 9.3, Iocharger firmware for AC models)
- [CVE-2024-43649](https://cve.now/CVE-2024-43649.md): Authenticated command injection via \<redacted\>.exe \<redacted\> parameter (CVSS 9.3, Iocharger firmware for AC models)
- [CVE-2024-43660](https://cve.now/CVE-2024-43660.md): Arbitrary file download using \<redacted\>.sh (CVSS 7.1, Iocharger firmware for AC models)
- [CVE-2024-43653](https://cve.now/CVE-2024-43653.md): Authenticated command injection in the \<redacted\> action leads to full remote code execution as root on the charging station (CVSS 9.3, Iocharger firmware for AC models)
- [CVE-2024-43661](https://cve.now/CVE-2024-43661.md): Buffer overflow in \<redacted\>.so leads to DoS of OCPP service (CVSS 7.1, Iocharger firmware for AC models)
- [CVE-2024-43652](https://cve.now/CVE-2024-43652.md): Authenticated command injection in the \<redacted\> action leads to full remote code execution as root on the charging station (CVSS 9.3, Iocharger firmware for AC chargers)
- [CVE-2024-43657](https://cve.now/CVE-2024-43657.md): When uploading new firmware, a shell script inside a firmware file is executed during its processing. This can be used to craft a custom firmware file with a custom script with arbitrary code, which will then be executed on the charging station. (CVSS 9.3, Iocharger firmware for AC models)
- [CVE-2024-43648](https://cve.now/CVE-2024-43648.md): Authenticated command injection via \<redacted\>.exe \<redacted\> parameter (CVSS 9.3, Iocharger firmware for AC models)
- [CVE-2024-43663](https://cve.now/CVE-2024-43663.md): Buffer overflow vulnerabilities in CGI scripts lead to segfault (CVSS 5.3, Iocharger firmware for AC models)
- [CVE-2024-43659](https://cve.now/CVE-2024-43659.md): Plaintext default credentials in firmware (CVSS 8.3, Iocharger firmware for AC models)
- [CVE-2024-43656](https://cve.now/CVE-2024-43656.md): A backup can be manipulated and then restored to create arbitrary files inside the \<redacted\> directory. A CGI script can be added to the web directory this way, allowing for full remote code execution. (CVSS 9.3, Iocharger firmware for AC models)
- [CVE-2024-43662](https://cve.now/CVE-2024-43662.md): Authenticated arbitrary file upload to /tmp/ and /tmp/upload/ (CVSS 5.3, Iocharger firmware for AC models)
- [CVE-2024-43650](https://cve.now/CVE-2024-43650.md): Authenticated command injection in the \<redacted\> action leads to full remote code execution as root on the charging station (CVSS 9.3, Iocharger firmware for AC models)
- [CVE-2024-43655](https://cve.now/CVE-2024-43655.md): Any authenticated users can execute OS commands as root using the \<redacted\>.sh CGI script. (CVSS 9.3, Iocharger firmware for AC models)
- [CVE-2025-0342](https://cve.now/CVE-2025-0342.md): CampCodes Computer Laboratory Management System edit cross site scripting (CVSS 5.3, CampCodes Computer Laboratory Management System)
- [CVE-2025-0341](https://cve.now/CVE-2025-0341.md): CampCodes Computer Laboratory Management System edit unrestricted upload (CVSS 5.3, CampCodes Computer Laboratory Management System)
- [CVE-2024-12806](https://cve.now/CVE-2024-12806.md): A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file. (CVSS 4.9, SonicWall SonicOS)
- [CVE-2023-1907](https://cve.now/CVE-2023-1907.md): Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session (CVSS 8.0, pgadmin · pgadmin4)
- [CVE-2024-12805](https://cve.now/CVE-2024-12805.md): A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads t (CVSS 7.2, SonicWall SonicOS)
- [CVE-2024-12803](https://cve.now/CVE-2024-12803.md): A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and poten (CVSS 7.2, SonicWall SonicOS)
- [CVE-2024-40765](https://cve.now/CVE-2024-40765.md): An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of S (CVSS 9.8, SonicWall SonicOS)
- [CVE-2024-53706](https://cve.now/CVE-2024-53706.md): A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-privileged attacker to elevate privileges to (CVSS 7.8, SonicWall SonicOS)
- [CVE-2025-0340](https://cve.now/CVE-2025-0340.md): code-projects Cinema Seat Reservation System deleteBooking.php sql injection (CVSS 6.9, code-projects Cinema Seat Reservation System)
- [CVE-2025-0339](https://cve.now/CVE-2025-0339.md): code-projects Online Bike Rental HTTP GET Request vehical-details.php cross site scripting (CVSS 5.3, code-projects Online Bike Rental)
- [CVE-2024-53705](https://cve.now/CVE-2024-53705.md): A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection t (CVSS 7.5, SonicWall SonicOS)
- [CVE-2025-22445](https://cve.now/CVE-2025-22445.md): Misleading UI for undefined admin console settings in Calls causes security confusion (CVSS 3.5, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-20033](https://cve.now/CVE-2025-20033.md): DoS via custom post type for sysconsole plugin readers (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-22449](https://cve.now/CVE-2025-22449.md): Access control flaw for team admins allows unauthorized team additions (CVSS 3.8, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-53704](https://cve.now/CVE-2024-53704.md): An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. (CVSS 8.2, KEV, SonicWall SonicOS)
- [CVE-2024-40762](https://cve.now/CVE-2024-40762.md): Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain ca (CVSS 9.8, SonicWall SonicOS)
- [CVE-2024-13041](https://cve.now/CVE-2024-13041.md): Incorrect User Management in GitLab (CVSS 4.2, GitLab)
- [CVE-2025-0336](https://cve.now/CVE-2025-0336.md): Codezips Project Management System teacher.php sql injection (CVSS 5.3, Codezips Project Management System)
- [CVE-2024-6324](https://cve.now/CVE-2024-6324.md): Inefficient Algorithmic Complexity in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-0335](https://cve.now/CVE-2025-0335.md): code-projects Online Bike Rental System Change Image unrestricted upload (CVSS 5.3, code-projects Online Bike Rental System)
- [CVE-2024-12736](https://cve.now/CVE-2024-12736.md): BU Section Editing \<= 0.9.9 - Reflected XSS (CVSS 6.1, BU Section Editing)
- [CVE-2024-12731](https://cve.now/CVE-2024-12731.md): aklamator-infeed \<= 2.0.0 - Reflected XSS (CVSS 6.1, Aklamator INfeed)
- [CVE-2025-0334](https://cve.now/CVE-2025-0334.md): leiyuxi cy-fast listData sql injection (CVSS 5.3, leiyuxi cy-fast)
- [CVE-2024-12717](https://cve.now/CVE-2024-12717.md): aklamator-infeed \<= 2.0.0 - Admin+ Stored XSS (CVSS 4.8, Aklamator INfeed)
- [CVE-2024-12715](https://cve.now/CVE-2024-12715.md): Asgard Security Scanner \<= 0.7 - Reflected XSS (CVSS 6.1, Asgard Security Scanner)
- [CVE-2024-12714](https://cve.now/CVE-2024-12714.md): Backlink Monitoring Manager \<= 0.1.3 - Reflected XSS (CVSS 6.1, Backlink Monitoring Manager)
- [CVE-2024-10815](https://cve.now/CVE-2024-10815.md): PostLists \<= 2.0.2 - Reflected XSS (CVSS 4.2, PostLists)
- [CVE-2025-0333](https://cve.now/CVE-2025-0333.md): leiyuxi cy-fast listData sql injection (CVSS 5.3, leiyuxi cy-fast)
- [CVE-2025-0331](https://cve.now/CVE-2025-0331.md): YunzMall HTTP POST Request ResetpwdController.php changePwd password recovery (CVSS 6.9, YunzMall)
- [CVE-2025-0328](https://cve.now/CVE-2025-0328.md): KaiYuanTong ECT Platform HTTP POST Request runCode.php command injection (CVSS 6.9, KaiYuanTong ECT Platform)
- [CVE-2025-0306](https://cve.now/CVE-2025-0306.md): Ruby: openssl: ruby marvin attack (CVSS 7.4, Ruby · Red Hat Enterprise Linux +1)
- [CVE-2024-13213](https://cve.now/CVE-2024-13213.md): SingMR HouseRent toAdminUpdateHousePage cross site scripting (CVSS 5.3, SingMR HouseRent)
- [CVE-2024-13212](https://cve.now/CVE-2024-13212.md): SingMR HouseRent AddHouseController.java upload unrestricted upload (CVSS 5.3, SingMR HouseRent)
- [CVE-2024-56827](https://cve.now/CVE-2024-56827.md): Openjpeg: heap buffer overflow in lib/openjp2/j2k.c (CVSS 5.6, openjpeg · Red Hat Enterprise Linux)
- [CVE-2024-56826](https://cve.now/CVE-2024-56826.md): Openjpeg: heap buffer overflow in bin/common/color.c (CVSS 5.6, openjpeg · Red Hat Enterprise Linux)
- [CVE-2024-13211](https://cve.now/CVE-2024-13211.md): SingMR HouseRent AdminController.java access control (CVSS 5.3, SingMR HouseRent)
- [CVE-2024-13210](https://cve.now/CVE-2024-13210.md): donglight bookstore电商书城系统说明 AdminBookController. java uploadPicture unrestricted upload (CVSS 5.1, donglight bookstore电商书城系统说明)
- [CVE-2024-13209](https://cve.now/CVE-2024-13209.md): Redaxo CMS Structure Management Page index.php cross site scripting (CVSS 5.1, Redaxo CMS · redaxo/source)
- [CVE-2024-13206](https://cve.now/CVE-2024-13206.md): REVE Antivirus reveinstall default permission (CVSS 8.5, REVE Antivirus)
- [CVE-2024-13205](https://cve.now/CVE-2024-13205.md): kurniaramadhan E-Commerce-PHP Create Product Page create\_product.php cross site scripting (CVSS 5.1, kurniaramadhan E-Commerce-PHP)
- [CVE-2024-13204](https://cve.now/CVE-2024-13204.md): kurniaramadhan E-Commerce-PHP blog-details.php sql injection (CVSS 5.3, kurniaramadhan E-Commerce-PHP)
- [CVE-2024-13203](https://cve.now/CVE-2024-13203.md): kurniaramadhan E-Commerce-PHP cross-site request forgery (CVSS 6.9, kurniaramadhan E-Commerce-PHP)
- [CVE-2024-13202](https://cve.now/CVE-2024-13202.md): wander-chu SpringBoot-Blog Blog Article PageController.java modifiyArticle cross site scripting (CVSS 5.1, wander-chu SpringBoot-Blog)
- [CVE-2024-13201](https://cve.now/CVE-2024-13201.md): wander-chu SpringBoot-Blog Admin Attachment AttachtController.java upload unrestricted upload (CVSS 5.1, wander-chu SpringBoot-Blog)
- [CVE-2024-13200](https://cve.now/CVE-2024-13200.md): wander-chu SpringBoot-Blog HTTP POST Request BaseInterceptor.java preHandle access control (CVSS 6.9, wander-chu SpringBoot-Blog)
- [CVE-2023-23913](https://cve.now/CVE-2023-23913.md): There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are as (CVSS 6.3, rails-ujs · actionview)
- [CVE-2023-27531](https://cve.now/CVE-2023-27531.md): There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code (CVSS 5.3, Rails Kredis JSON · kredis)
- [CVE-2023-27539](https://cve.now/CVE-2023-27539.md): There is a denial of service vulnerability in the header parsing component of Rack. (CVSS 5.3, Rails Rack · rack)
- [CVE-2023-28362](https://cve.now/CVE-2023-28362.md): The redirect\_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. (CVSS 4.0, Rails Action Pack · actionpack)
- [CVE-2024-27980](https://cve.now/CVE-2024-27980.md): Due to the improper handling of batch files in child\_process.spawn / child\_process.spawnSync, a malicious command line argument can inject a (CVSS 8.1, NodeJS Node)
- [CVE-2023-38037](https://cve.now/CVE-2023-38037.md): ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. (CVSS 5.5, Rails ActiveSupport · activesupport)
- [CVE-2024-37372](https://cve.now/CVE-2024-37372.md): The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not alw (CVSS 3.6, NodeJS Node)
- [CVE-2023-28120](https://cve.now/CVE-2023-28120.md): There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. (CVSS 5.3, Rails ActiveSupport · activesupport)
- [CVE-2024-13199](https://cve.now/CVE-2024-13199.md): langhsu Mblog Blog System Search Bar search cross site scripting (CVSS 5.3, langhsu Mblog Blog System)
- [CVE-2024-13198](https://cve.now/CVE-2024-13198.md): langhsu Mblog Blog System login observable response discrepancy (CVSS 6.3, langhsu Mblog Blog System)
- [CVE-2024-13197](https://cve.now/CVE-2024-13197.md): donglight bookstore电商书城系统说明 AdminUserControlle.java updateUser cross site scripting (CVSS 5.3, donglight bookstore电商书城系统说明)
- [CVE-2024-13196](https://cve.now/CVE-2024-13196.md): donglight bookstore电商书城系统说明 BookInfoController.java BookSearchList cross site scripting (CVSS 5.3, donglight bookstore电商书城系统说明)
- [CVE-2023-28354](https://cve.now/CVE-2023-28354.md): An issue was discovered in Opsview Monitor Agent 6.8. (CVSS 9.8)
- [CVE-2024-42898](https://cve.now/CVE-2024-42898.md): A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted p (CVSS 5.4)
- [CVE-2024-46464](https://cve.now/CVE-2024-46464.md): In PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user access can be manipulated to render the host (CVSS 7.8)
- [CVE-2024-46505](https://cve.now/CVE-2024-46505.md): Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities. (CVSS 9.1)
- [CVE-2024-48806](https://cve.now/CVE-2024-48806.md): Buffer Overflow vulnerability in Neat Board NFC v.1.20240620.0015 allows a physically proximate attackers to escalate privileges via a craft (CVSS 6.8)
- [CVE-2024-51229](https://cve.now/CVE-2024-51229.md): Cross Site Scripting vulnerability in LinZhaoguan pb-cms v.2.0 allows a remote attacker to execute arbitrary code via the theme management f (CVSS 8.8)
- [CVE-2024-54724](https://cve.now/CVE-2024-54724.md): PHPYun before 7.0.2 is vulnerable to code execution through backdoor-restricted arbitrary file writing and file inclusion. (CVSS 9.8)
- [CVE-2024-54761](https://cve.now/CVE-2024-54761.md): BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev\_code' parameter. (CVSS 6.3)
- [CVE-2024-54762](https://cve.now/CVE-2024-54762.md): Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability. (CVSS 6.3)
- [CVE-2024-54887](https://cve.now/CVE-2024-54887.md): TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /user (CVSS 8.0)
- [CVE-2024-55224](https://cve.now/CVE-2024-55224.md): An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload i (CVSS 9.6, vaultwarden)
- [CVE-2024-55225](https://cve.now/CVE-2024-55225.md): An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrator (CVSS 9.8, vaultwarden)
- [CVE-2024-55226](https://cve.now/CVE-2024-55226.md): Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/cor (CVSS 5.4, vaultwarden)
- [CVE-2024-55494](https://cve.now/CVE-2024-55494.md): A PHP Code Injection vulnerability that can lead to Remote Code Execution (RCE) and XSS in Opencode Mobile Collect Call v5.4.7 allows attack (CVSS 6.1)
- [CVE-2024-56113](https://cve.now/CVE-2024-56113.md): Smart Toilet Lab - Motius 1.3.11 is running with debug mode turned on (DEBUG = True) and exposing sensitive information defined in Django se (CVSS 7.5)
- [CVE-2024-56114](https://cve.now/CVE-2024-56114.md): Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result (CVSS 6.5)
- [CVE-2024-56376](https://cve.now/CVE-2024-56376.md): A stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6 allows authenticated users to inject malicious (CVSS 5.4, Vanderbilt REDCap)
- [CVE-2024-56377](https://cve.now/CVE-2024-56377.md): A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts i (CVSS 5.4, Vanderbilt REDCap)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.