CVEs published January 13, 2025
113 CVEs were published on January 13, 2025: 6 critical, 36 high.
- Published
- 113
- Critical
- 6
- High
- 36
- Medium
- 62
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- LabRedesCefetRJ WeGIA
- 16
- Imagination Technologies Graphics DDK
- 7
- liujianview gymxmjpa
- 7
- Email Subscribers by Icegram Express
- 4
- Venki Supravizio BPM
- 3
- NamelessMC Nameless
- 2
- notaryproject notation-go · github.com/notaryproject/notati…
- 2
- OFFIS DCMTK
- 2
- 1902756969 reggie
- 1
- anshulsojatia Scan External Links
- 1
Critical 6
- CVE-2025-22144Account Takeover in NamelessMCNamelessMC Nameless
- CVE-2024-5743Command Injection VulnerabilityEveHome Eve Play
- CVE-2025-22777WordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerabilityStellarWP GiveWP
- CVE-2024-46310Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via expose
- CVE-2024-46479Venki Supravizio BPM through 18.0.1 was discovered to contain an arbitrary file upload vulnerability.Venki Supravizio BPM
- CVE-2024-57811In Eaton X303 3.5.16 - X303 3.5.17 Build 712, an attacker with network access to a XC-303 PLC can login as root over SSH.
High 36
- CVE-2024-11128Insufficient Hardened Runtime or Library Validation signing in Bitdefender Virus Scanner for macOSBitdefender Virus Scanner
- CVE-2024-52333An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8.OFFIS DCMTK
- CVE-2024-47796An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8.OFFIS DCMTK
- CVE-2024-56065WordPress WP2LEADS Plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilitySaleswonder Team: Tobias WP2LEADS
- CVE-2024-56301WordPress Distance Based Shipping Calculator Plugin <= 2.0.21 - Reflected Cross Site Scripting (XSS) vulnerabilityenituretechnology Distance Based Shipping Calculator
- CVE-2025-22314WordPress Food Store plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilityWP Scripts Food Store – Online Food Delivery & Pickup
- CVE-2025-22337WordPress Order Audit Log for WooCommerce plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityinfosoftplugin Order Audit Log for WooCommerce
- CVE-2025-22344WordPress Media Category Library plugin <= 2.7 - Reflected Cross Site Scripting (XSS) vulnerabilitytimmcdaniels Media Category Library
- CVE-2025-22498WordPress LucidLMS plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityN3wNormal LucidLMS
- CVE-2025-22499WordPress F4 Post Tree Plugin <= 1.1.18 - Reflected Cross Site Scripting (XSS) vulnerabilityFAKTOR VIER F4 Post Tree
- CVE-2025-22506WordPress Smart Agenda Plugin <= 4.7 - CSRF to Stored XSS vulnerabilitySmart Agenda
- CVE-2025-22514WordPress Axact Author List Widget Plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityYamna Khawaja KNR Author List Widget
- CVE-2025-22567WordPress TRUSTist REVIEWer Plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityTRUSTist REVIEWer
- CVE-2025-22568WordPress Post And Page Reactions Plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityarete-it Post And Page Reactions
- CVE-2025-22569WordPress Featured Page Widget Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityGrandSlambert Featured Page Widget
- CVE-2025-22570WordPress Inline Tweets plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilitymdjekic Inline Tweets
- CVE-2025-22576WordPress Site PIN Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMarcus Downing Site PIN
- CVE-2025-22583WordPress Scan External Links Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityanshulsojatia Scan External Links
- CVE-2025-22586WordPress WPEX Replace DB Urls Plugin <= 0.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilitydstoever WPEX Replace DB Urls
- CVE-2025-22588WordPress Scanventory Plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityintelligence_lab Scanventory
- CVE-2024-52938GPU DDK - rgxfw_pm_add_freelist_for_reconstruction OOB writeImagination Technologies Graphics DDK
- CVE-2024-47895GPU DDK - OOB read into fwlog due to unchecked block countImagination Technologies Graphics DDK
- CVE-2024-47894GPU DDK - Out of bounds read into fwlog due to unchecked loop boundsImagination Technologies Graphics DDK
- CVE-2024-47897GPU DDK - PVRSRVRGXGetEnabledHWPerfBlocksKM off-by-one OOB writeImagination Technologies Graphics DDK
- CVE-2024-12274BookingPress < 1.1.23 - Unauthenticated Export File DownloadAppointment Booking Calendar Plugin and Scheduling Plugin
- CVE-2025-0412Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution VulnerabilityLuxion KeyShot Viewer
- CVE-2023-42225Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Attachment/DownloadTempFile function.
- CVE-2023-42226Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via Email/SaveAttachment function.
- CVE-2023-42227Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the WSCView/Save function.
- CVE-2023-42228Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control.
- CVE-2023-42231Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control.
- CVE-2023-42232Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Navigator/Index function.
- CVE-2023-42244An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.
- CVE-2024-46480An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate privVenki Supravizio BPM
- CVE-2024-46481The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS.Venki Supravizio BPM
- CVE-2025-22963Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.Sismics Teedy
Medium, low and unrated 71
- CVE-2025-23038Cross-Site Scripting (XSS) Stored endpoint 'remuneracao.php ' parameter 'descricao' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-23030Cross-Site Scripting (XSS) Reflected endpoint 'cadastro_funcionario.php' parameter 'cpf' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-23031Cross-Site Scripting (XSS) Stored endpoint 'adicionar_alergia.php' parameter 'nome' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-23032Cross-Site Scripting (XSS) Stored endpoint 'adicionar_escala.php' parameter 'escala' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-23033Cross-Site Scripting (XSS) Stored endpoint 'adicionar_situacao.php' parameter 'situacao' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-23034Cross-Site Scripting (XSS) Reflected endpoint 'tags.php' parameter 'msg_e' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-23035Cross-Site Scripting (XSS) Stored endpoint 'adicionar_tipo_quadro_horario.php' parameter 'tipo' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-23036Cross-Site Scripting (XSS) Reflected endpoint 'pre_cadastro_funcionario.php' parameter 'msg_e' in WeGIALabRedesCefetRJ WeGIA
- CVE-2025-23037Cross-Site Scripting (XSS) Stored endpoint 'control.php' parameter 'cargo' in WeGIALabRedesCefetRJ WeGIA
- CVE-2024-11396Event monster <= 1.4.3 - Information Exposure Via Visitors List Exportawordpresslife Event Monster – Manager & Ticket Booking
- CVE-2024-51491Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-gonotaryproject notation-go · github.com/notaryproject/notati…
- CVE-2024-56138Timestamp signature generation lacks certificate revocation check in notion-gonotaryproject notation-go · github.com/notaryproject/notati…
- CVE-2024-56323OpenFGA Authorization Bypassopenfga · github.com/openfga/openfga
- CVE-2025-22613WeGIA Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'LabRedesCefetRJ WeGIA
- CVE-2025-22614WeGIA Cross-Site Scripting (XSS) Stored endpoint 'dependente_editarInfoPessoal.php ' parameters 'nome' 'SobrenomeForm'LabRedesCefetRJ WeGIA
- CVE-2025-22615WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'Cadastro_Atendido.php' parameter 'cpf'LabRedesCefetRJ WeGIA
- CVE-2025-22616WeGIA Cross-Site Scripting (XSS) Stored endpoint 'dependente_parentesco_adicionar.php' parameter 'descricao'LabRedesCefetRJ WeGIA
- CVE-2025-22617WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'editar_socio.php' parameter 'socio'LabRedesCefetRJ WeGIA
- CVE-2025-22618WeGIA Cross-Site Scripting (XSS) Stored endpoint 'adicionar_cargo.php' parameter 'cargo'LabRedesCefetRJ WeGIA
- CVE-2025-22619WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'editar_permissoes.php' parameter 'msg_c'LabRedesCefetRJ WeGIA
- CVE-2025-22134heap-buffer-overflow with visual mode in Vim < 9.1.1003vim
- CVE-2025-22138Private categories allow suggested edits to be viewed via the queue in @codidact/qpixelcodidact qpixel
- CVE-2025-22142Cross-site Scripting in NamelessMCNamelessMC Nameless
- CVE-2025-23027BASEHUB_TOKEN commited in next-forgehaydenbleasel next-forge
- CVE-2025-23026HTML templates containing Javascript template strings are subject to XSS in jtecasid jte · gg.jte:jte +1
- CVE-2024-6352Malformed packet leads to denial of service in APS layersilabs.com SiSDK
- CVE-2024-12211Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.Pegasystems Pega Infinity
- CVE-2025-22800WordPress Post SMTP plugin <= 2.9.11 - Broken Access Control vulnerabilitySaad Iqbal Post SMTP
- CVE-2025-22828Apache CloudStack: Unauthorised access to annotationsApache Software Foundation Apache CloudStack
- CVE-2024-52937GPU DDK - rgxfw_kernel_CMD_DISABLE_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStoreImagination Technologies Graphics DDK
- CVE-2024-52936GPU DDK - rgxfw_hwperf_config OOB read & writeImagination Technologies Graphics DDK
- CVE-2024-52935GPU DDK - psContext->eDM gives OOB writeImagination Technologies Graphics DDK
- CVE-2024-12568Email Subscribers < 5.7.45 - Admin+ Stored XSSEmail Subscribers by Icegram Express
- CVE-2024-12567Email Subscribers < 5.7.45 - Admin+ Stored XSSEmail Subscribers by Icegram Express
- CVE-2024-12566Email Subscribers < 5.7.45 - Admin+ Stored XSSEmail Subscribers by Icegram Express
- CVE-2024-11636Email Subscribers < 5.7.45 - Admin+ Stored XSSEmail Subscribers by Icegram Express
- CVE-2025-0410liujianview gymxmjpa MenberConntroller.java MenberDaoInpl sql injectionliujianview gymxmjpa
- CVE-2025-0409liujianview gymxmjpa MembertypeController.java MembertypeDaoImpl sql injectionliujianview gymxmjpa
- CVE-2025-0408liujianview gymxmjpa LoosController.java LoosDaoImpl sql injectionliujianview gymxmjpa
- CVE-2025-0407liujianview gymxmjpa EquipmentController.java EquipmentDaoImpl sql injectionliujianview gymxmjpa
- CVE-2025-0406liujianview gymxmjpa SubjectController.java SubjectDaoImpl sql injectionliujianview gymxmjpa
- CVE-2025-0405liujianview gymxmjpa GoodsController.java GoodsDaoImpl sql injectionliujianview gymxmjpa
- CVE-2025-0404liujianview gymxmjpa CoachController.java CoachController sql injectionliujianview gymxmjpa
- CVE-2025-04031902756969 reggie Phone Number Validation sendMsg information disclosure1902756969 reggie
- CVE-2023-42229Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal.
- CVE-2023-42230Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the WSCView/Save function.
- CVE-2023-42233Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the Filter/FilterEditor function.
- CVE-2023-42234Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Request Forgery (CSRF) via the WSCView function.
- CVE-2023-42235An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.
- CVE-2023-42236An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.
- CVE-2023-42237An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.
- CVE-2023-42238An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.
- CVE-2023-42239An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.
- CVE-2023-42240An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.
- CVE-2023-42241An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.
- CVE-2023-42242An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.
- CVE-2023-42243In Selesta Visual Access Manager < 4.42.2, an authenticated user can access the administrative page /common/vam_Sql.php, which allows for ar
- CVE-2023-42245Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_scheduledfile.php.
- CVE-2023-42246Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /vam/vam_ep.php.
- CVE-2023-42247Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_monitor_map.php.
- CVE-2023-42248An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2.
- CVE-2023-42249Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via vam/vam_visits.php.
- CVE-2023-42250Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /common/autocomplete.php.
- CVE-2024-44771BigId PrivacyPortal v179 is vulnerable to Cross Site Scripting (XSS) via the "Label" field in the Report template function.
- CVE-2024-46919An issue was discovered in Samsung Mobile Processor Exynos 9820, 9825, 980, 990, 850, 1080, 2100, and 1280.
- CVE-2024-46920An issue was discovered in Samsung Mobile Processor Exynos 9820, 9825, 980, 990, 850, 1080, 2100, and 1280.
- CVE-2024-46921An issue was discovered in Samsung Mobile Processor and Modem Exynos 9820, 9825, 980, 990, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9
- CVE-2024-48883An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200,
- CVE-2024-54999MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter the General Information module.
- CVE-2024-57487In Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker
- CVE-2024-57488Code-Projects Online Car Rental System 1.0 is vulnerable to Cross Site Scripting (XSS) via the vehicalorcview parameter in /admin/edit-vehic