# CVEs published 2025-01-10

72 CVEs were published on January 10, 2025: 15 critical, 17 high. Days are UTC.

- [CVE-2024-9188](https://cve.now/CVE-2024-9188.md): Specially constructed queries cause cross platform scripting leaking administrator tokens (CVSS 8.8, Arista Networks Arista Edge Threat Management)
- [CVE-2024-47520](https://cve.now/CVE-2024-47520.md): A user with advanced report application access rights can perform actions for which they are not authorized (CVSS 7.6, Arista Networks Arista Edge Threat Management)
- [CVE-2024-47519](https://cve.now/CVE-2024-47519.md): Backup uploads to ETM subject to man-in-the-middle interception (CVSS 8.3, Arista Networks Arista Edge Threat Management)
- [CVE-2024-47518](https://cve.now/CVE-2024-47518.md): Specially constructed queries targeting ETM could discover active remote access sessions (CVSS 6.4, Arista Networks Arista Edge Threat Management)
- [CVE-2024-47517](https://cve.now/CVE-2024-47517.md): Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access (CVSS 6.8, Arista Networks Arista Edge Threat Management)
- [CVE-2024-9134](https://cve.now/CVE-2024-9134.md): Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges. (CVSS 8.3, Arista Networks Arista Edge Threat Management)
- [CVE-2024-9133](https://cve.now/CVE-2024-9133.md): A user with administrator privileges is able to retrieve authentication tokens (CVSS 6.6, Arista Networks Arista Edge Threat Management)
- [CVE-2024-9132](https://cve.now/CVE-2024-9132.md): The administrator is able to configure an insecure captive portal script (CVSS 8.1, Arista Networks Arista Edge Threat Management)
- [CVE-2024-9131](https://cve.now/CVE-2024-9131.md): A user with administrator privileges can perform command injection (CVSS 7.2, Arista Networks Arista Edge Threat Management)
- [CVE-2024-7142](https://cve.now/CVE-2024-7142.md): On Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only), the disk encryption might not be successfully performed. This results in the disks remaining unsecured and data on them (CVSS 4.6, Arista Networks CloudVision Appliance)
- [CVE-2024-5872](https://cve.now/CVE-2024-5872.md): On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as route flaps, multicast routes learnt, etc. (CVSS 6.5, Arista Networks EOS)
- [CVE-2024-7095](https://cve.now/CVE-2024-7095.md): On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being term (CVSS 4.3, Arista Networks EOS)
- [CVE-2024-6437](https://cve.now/CVE-2024-6437.md): On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options ma (CVSS 5.8, Arista Networks EOS-Policy Based Routing · Arista Networ… +1)
- [CVE-2024-12847](https://cve.now/CVE-2024-12847.md): NETGEAR DGN setup.cgi OS Command Injection (CVSS 9.8, NETGEAR DGN1000)
- [CVE-2025-23079](https://cve.now/CVE-2025-23079.md): XSSes in Extension:ArticleFeedbackv5 (CVSS 6.1, Wikimedia Foundation Mediawiki - ArticleFeedbackv5 extension)
- [CVE-2025-23078](https://cve.now/CVE-2025-23078.md): XSS in BreadCrumbs2 (CVSS 6.5, Wikimedia Foundation Mediawiki - Breadcrumbs2 extension)
- [CVE-2024-6880](https://cve.now/CVE-2024-6880.md): CSRF in MegaBIP (CVSS 6.9, Jan Syski MegaBIP)
- [CVE-2024-6662](https://cve.now/CVE-2024-6662.md): CSRF in MegaBIP (CVSS 8.7, Jan Syski MegaBIP)
- [CVE-2025-22600](https://cve.now/CVE-2025-22600.md): WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint \`configuracao\_doacao.php\` parameter \`avulso\` (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-22599](https://cve.now/CVE-2025-22599.md): WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint \`home.php\` parameter \`msg\_c\` (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-22598](https://cve.now/CVE-2025-22598.md): WeGIA has a Cross-Site Scripting (XSS) Stored endpoint 'cadastrarSocio.php' parameter 'nome' (CVSS 8.3, LabRedesCefetRJ WeGIA)
- [CVE-2025-22597](https://cve.now/CVE-2025-22597.md): WeGIA has a Cross-Site Scripting (XSS) Stored endpoint 'CobrancaController.php' parameter 'local\_recepcao' (CVSS 8.3, LabRedesCefetRJ WeGIA)
- [CVE-2025-22596](https://cve.now/CVE-2025-22596.md): WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint 'modulos\_visiveis.php' parameter'msg\_c' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-22152](https://cve.now/CVE-2025-22152.md): Improper Path Validation Enables Path Traversal in Multiple Components in Atheos (CVSS 9.4, Atheos)
- [CVE-2024-56511](https://cve.now/CVE-2024-56511.md): DataEase has an unauthorized vulnerability (CVSS 9.3, dataease)
- [CVE-2024-41787](https://cve.now/CVE-2024-41787.md): IBM Engineering Requirements Management DOORS Next code execution (CVSS 9.8, IBM Engineering Requirements Management DOORS Next)
- [CVE-2024-13318](https://cve.now/CVE-2024-13318.md): Essential WP Real Estate \<= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletion (CVSS 5.3, smartdatasoft Essential WP Real Estate)
- [CVE-2024-13183](https://cve.now/CVE-2024-13183.md): Orbit Fox by ThemeIsle \<= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title\_tag Parameter (CVSS 6.4, themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…)
- [CVE-2025-0311](https://cve.now/CVE-2025-0311.md): Orbit Fox by ThemeIsle \<= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget (CVSS 6.4, themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…)
- [CVE-2024-12473](https://cve.now/CVE-2024-12473.md): AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) \<= 2.5 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, opacewebdesign Opace AI Scribe: SEO Content Creator & Humai…)
- [CVE-2024-12606](https://cve.now/CVE-2024-12606.md): AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) \<= 2.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, opacewebdesign Opace AI Scribe: SEO Content Creator & Humai…)
- [CVE-2024-25371](https://cve.now/CVE-2024-25371.md): Gramine before a390e33e16ed374a40de2344562a937f289be2e1 suffers from an Interface vulnerability due to mismatching SW signals vs HW exceptio (CVSS 7.5)
- [CVE-2024-29970](https://cve.now/CVE-2024-29970.md): Fortanix Enclave OS 3.36.1941-EM has an interface vulnerability that leads to state corruption via injected signals. (CVSS 9.8)
- [CVE-2024-29971](https://cve.now/CVE-2024-29971.md): Scontain SCONE 5.8.0 has an interface vulnerability that leads to state corruption via injected signals. (CVSS 9.8)
- [CVE-2024-33297](https://cve.now/CVE-2024-33297.md): Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal (CVSS 4.7, microweber/microweber)
- [CVE-2024-33298](https://cve.now/CVE-2024-33298.md): Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new ba (CVSS 6.1, microweber/microweber)
- [CVE-2024-33299](https://cve.now/CVE-2024-33299.md): Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name (CVSS 4.7, microweber/microweber)
- [CVE-2024-46210](https://cve.now/CVE-2024-46210.md): An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploadin (CVSS 7.2)
- [CVE-2024-50807](https://cve.now/CVE-2024-50807.md): Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting (XSS) via file upload using the svg and pdf extensions. (CVSS 6.1)
- [CVE-2024-54687](https://cve.now/CVE-2024-54687.md): Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity (CVSS 6.1)
- [CVE-2024-54846](https://cve.now/CVE-2024-54846.md): An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the EC private key and access sensitive data or execute a man-in-t (CVSS 5.9)
- [CVE-2024-54847](https://cve.now/CVE-2024-54847.md): An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to access the Diffie-Hellman (DH) parameters and access sensitive data or ex (CVSS 5.9)
- [CVE-2024-54848](https://cve.now/CVE-2024-54848.md): Improper handling and storage of certificates in CP Plus CP-VNR-3104 B3223P22C02424 allow attackers to decrypt communications or execute a m (CVSS 7.4)
- [CVE-2024-54849](https://cve.now/CVE-2024-54849.md): An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the second RSA private key and access sensitive data or execute a (CVSS 5.9)
- [CVE-2024-54910](https://cve.now/CVE-2024-54910.md): Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function. (CVSS 4.7)
- [CVE-2024-54994](https://cve.now/CVE-2024-54994.md): MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first\_name and last\_name parameters in the (CVSS 6.5)
- [CVE-2024-54996](https://cve.now/CVE-2024-54996.md): MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description paramet (CVSS 8.8)
- [CVE-2024-54997](https://cve.now/CVE-2024-54997.md): MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ (CVSS 5.4)
- [CVE-2024-54998](https://cve.now/CVE-2024-54998.md): MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:\[id\]/de (CVSS 5.4)
- [CVE-2024-57211](https://cve.now/CVE-2024-57211.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the enable\_ (CVSS 8.0)
- [CVE-2024-57212](https://cve.now/CVE-2024-57212.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parameter in the action\_reb (CVSS 5.1)
- [CVE-2024-57213](https://cve.now/CVE-2024-57213.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newpasswd parameter in the action\_ (CVSS 6.3)
- [CVE-2024-57214](https://cve.now/CVE-2024-57214.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname parameter in the reset\_wif (CVSS 6.3)
- [CVE-2024-57222](https://cve.now/CVE-2024-57222.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli\_cancel\_wps functi (CVSS 6.3)
- [CVE-2024-57223](https://cve.now/CVE-2024-57223.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli\_wps\_gen\_pincode f (CVSS 9.8)
- [CVE-2024-57224](https://cve.now/CVE-2024-57224.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli\_do\_enr\_pin\_wps fu (CVSS 9.8)
- [CVE-2024-57225](https://cve.now/CVE-2024-57225.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset\_wifi function. (CVSS 9.8)
- [CVE-2024-57226](https://cve.now/CVE-2024-57226.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif\_enable function. (CVSS 8.0)
- [CVE-2024-57227](https://cve.now/CVE-2024-57227.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli\_do\_enr\_pbc\_wps fu (CVSS 8.0)
- [CVE-2024-57228](https://cve.now/CVE-2024-57228.md): Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif\_disable function. (CVSS 8.0)
- [CVE-2024-57686](https://cve.now/CVE-2024-57686.md): A Cross Site Scripting (XSS) vulnerability was found in /landrecordsys/admin/contactus.php in PHPGurukul Land Record System v1.0, which allo (CVSS 9.8)
- [CVE-2024-57687](https://cve.now/CVE-2024-57687.md): An OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows re (CVSS 9.8)
- [CVE-2024-57822](https://cve.now/CVE-2024-57822.md): In Raptor RDF Syntax Library through 2.0.16, there is a heap-based buffer over-read when parsing triples with the nquads parser in raptor\_nt (CVSS 4.0, librdf Raptor RDF Syntax Library)
- [CVE-2024-57823](https://cve.now/CVE-2024-57823.md): In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in raptor\_uri\_norma (CVSS 9.3, librdf Raptor RDF Syntax Library)
- [CVE-2025-22946](https://cve.now/CVE-2025-22946.md): Tenda ac9 v1.0 firmware v15.03.05.19 contains a stack overflow vulnerability in /goform/SetOnlineDevName, which may lead to remote arbitrary (CVSS 9.8)
- [CVE-2025-22949](https://cve.now/CVE-2025-22949.md): Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote arbitrary code exec (CVSS 9.8)
- [CVE-2025-23016](https://cve.now/CVE-2025-23016.md): FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLe (CVSS 9.3, FastCGI fcgi)
- [CVE-2025-23022](https://cve.now/CVE-2025-23022.md): FreeType 2.8.1 has a signed integer overflow in cf2\_doFlex in cff/cf2intrp.c. (CVSS 4.0, FreeType)
- [CVE-2025-23110](https://cve.now/CVE-2025-23110.md): An issue was discovered in REDCap 14.9.6. (CVSS 6.1, Vanderbilt REDCap)
- [CVE-2025-23111](https://cve.now/CVE-2025-23111.md): An issue was discovered in REDCap 14.9.6. (CVSS 4.7, Vanderbilt REDCap)
- [CVE-2025-23112](https://cve.now/CVE-2025-23112.md): An issue was discovered in REDCap 14.9.6. (CVSS 6.1, Vanderbilt REDCap)
- [CVE-2025-23113](https://cve.now/CVE-2025-23113.md): An issue was discovered in REDCap 14.9.6. (CVSS 3.4, Vanderbilt REDCap)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.