# CVEs published 2025-01-13

113 CVEs were published on January 13, 2025: 6 critical, 36 high. Days are UTC.

- [CVE-2025-23038](https://cve.now/CVE-2025-23038.md): Cross-Site Scripting (XSS) Stored endpoint 'remuneracao.php ' parameter 'descricao' in WeGIA (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-23030](https://cve.now/CVE-2025-23030.md): Cross-Site Scripting (XSS) Reflected endpoint 'cadastro\_funcionario.php' parameter 'cpf' in WeGIA (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-23031](https://cve.now/CVE-2025-23031.md): Cross-Site Scripting (XSS) Stored endpoint 'adicionar\_alergia.php' parameter 'nome' in WeGIA (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-23032](https://cve.now/CVE-2025-23032.md): Cross-Site Scripting (XSS) Stored endpoint 'adicionar\_escala.php' parameter 'escala' in WeGIA (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-23033](https://cve.now/CVE-2025-23033.md): Cross-Site Scripting (XSS) Stored endpoint 'adicionar\_situacao.php' parameter 'situacao' in WeGIA (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-23034](https://cve.now/CVE-2025-23034.md): Cross-Site Scripting (XSS) Reflected endpoint 'tags.php' parameter 'msg\_e' in WeGIA (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-23035](https://cve.now/CVE-2025-23035.md): Cross-Site Scripting (XSS) Stored endpoint 'adicionar\_tipo\_quadro\_horario.php' parameter 'tipo' in WeGIA (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-23036](https://cve.now/CVE-2025-23036.md): Cross-Site Scripting (XSS) Reflected endpoint 'pre\_cadastro\_funcionario.php' parameter 'msg\_e' in WeGIA (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-23037](https://cve.now/CVE-2025-23037.md): Cross-Site Scripting (XSS) Stored endpoint 'control.php' parameter 'cargo' in WeGIA (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2024-11396](https://cve.now/CVE-2024-11396.md): Event monster \<= 1.4.3 - Information Exposure Via Visitors List Export (CVSS 5.3, awordpresslife Event Monster – Manager & Ticket Booking)
- [CVE-2024-11128](https://cve.now/CVE-2024-11128.md): Insufficient Hardened Runtime or Library Validation signing in Bitdefender Virus Scanner for macOS (CVSS 8.4, Bitdefender Virus Scanner)
- [CVE-2024-51491](https://cve.now/CVE-2024-51491.md): Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go (CVSS 3.3, notaryproject notation-go · github.com/notaryproject/notati…)
- [CVE-2024-56138](https://cve.now/CVE-2024-56138.md): Timestamp signature generation lacks certificate revocation check in notion-go (CVSS 4.0, notaryproject notation-go · github.com/notaryproject/notati…)
- [CVE-2024-56323](https://cve.now/CVE-2024-56323.md): OpenFGA Authorization Bypass (CVSS 5.8, openfga · github.com/openfga/openfga)
- [CVE-2025-22613](https://cve.now/CVE-2025-22613.md): WeGIA Cross-Site Scripting (XSS) Stored endpoint 'informacao\_adicional.php' parameter 'descricao' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-22614](https://cve.now/CVE-2025-22614.md): WeGIA Cross-Site Scripting (XSS) Stored endpoint 'dependente\_editarInfoPessoal.php ' parameters 'nome' 'SobrenomeForm' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-22615](https://cve.now/CVE-2025-22615.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'Cadastro\_Atendido.php' parameter 'cpf' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-22616](https://cve.now/CVE-2025-22616.md): WeGIA Cross-Site Scripting (XSS) Stored endpoint 'dependente\_parentesco\_adicionar.php' parameter 'descricao' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-22617](https://cve.now/CVE-2025-22617.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'editar\_socio.php' parameter 'socio' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-22618](https://cve.now/CVE-2025-22618.md): WeGIA Cross-Site Scripting (XSS) Stored endpoint 'adicionar\_cargo.php' parameter 'cargo' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-22619](https://cve.now/CVE-2025-22619.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'editar\_permissoes.php' parameter 'msg\_c' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-22134](https://cve.now/CVE-2025-22134.md): heap-buffer-overflow with visual mode in Vim \< 9.1.1003 (CVSS 4.2, vim)
- [CVE-2025-22138](https://cve.now/CVE-2025-22138.md): Private categories allow suggested edits to be viewed via the queue in @codidact/qpixel (CVSS 5.1, codidact qpixel)
- [CVE-2025-22142](https://cve.now/CVE-2025-22142.md): Cross-site Scripting in NamelessMC (CVSS 6.3, NamelessMC Nameless)
- [CVE-2025-22144](https://cve.now/CVE-2025-22144.md): Account Takeover in NamelessMC (CVSS 9.0, NamelessMC Nameless)
- [CVE-2025-23027](https://cve.now/CVE-2025-23027.md): BASEHUB\_TOKEN commited in next-forge (CVSS 6.3, haydenbleasel next-forge)
- [CVE-2025-23026](https://cve.now/CVE-2025-23026.md): HTML templates containing Javascript template strings are subject to XSS in jte (CVSS 6.1, casid jte · gg.jte:jte +1)
- [CVE-2024-5743](https://cve.now/CVE-2024-5743.md): Command Injection Vulnerability (CVSS 9.8, EveHome Eve Play)
- [CVE-2024-6352](https://cve.now/CVE-2024-6352.md): Malformed packet leads to denial of service in APS layer (CVSS 4.3, silabs.com SiSDK)
- [CVE-2024-12211](https://cve.now/CVE-2024-12211.md): Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile. (CVSS 5.4, Pegasystems Pega Infinity)
- [CVE-2024-52333](https://cve.now/CVE-2024-52333.md): An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. (CVSS 8.4, OFFIS DCMTK)
- [CVE-2024-47796](https://cve.now/CVE-2024-47796.md): An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. (CVSS 8.4, OFFIS DCMTK)
- [CVE-2024-56065](https://cve.now/CVE-2024-56065.md): WordPress WP2LEADS Plugin \<= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Saleswonder Team: Tobias WP2LEADS)
- [CVE-2024-56301](https://cve.now/CVE-2024-56301.md): WordPress Distance Based Shipping Calculator Plugin \<= 2.0.21 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, enituretechnology Distance Based Shipping Calculator)
- [CVE-2025-22800](https://cve.now/CVE-2025-22800.md): WordPress Post SMTP plugin \<= 2.9.11 - Broken Access Control vulnerability (CVSS 4.3, Saad Iqbal Post SMTP)
- [CVE-2025-22314](https://cve.now/CVE-2025-22314.md): WordPress Food Store plugin \<= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Scripts Food Store – Online Food Delivery & Pickup)
- [CVE-2025-22337](https://cve.now/CVE-2025-22337.md): WordPress Order Audit Log for WooCommerce plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, infosoftplugin Order Audit Log for WooCommerce)
- [CVE-2025-22344](https://cve.now/CVE-2025-22344.md): WordPress Media Category Library plugin \<= 2.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, timmcdaniels Media Category Library)
- [CVE-2025-22498](https://cve.now/CVE-2025-22498.md): WordPress LucidLMS plugin \<= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, N3wNormal LucidLMS)
- [CVE-2025-22499](https://cve.now/CVE-2025-22499.md): WordPress F4 Post Tree Plugin \<= 1.1.18 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, FAKTOR VIER F4 Post Tree)
- [CVE-2025-22506](https://cve.now/CVE-2025-22506.md): WordPress Smart Agenda Plugin \<= 4.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, Smart Agenda)
- [CVE-2025-22514](https://cve.now/CVE-2025-22514.md): WordPress Axact Author List Widget Plugin \<= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Yamna Khawaja KNR Author List Widget)
- [CVE-2025-22567](https://cve.now/CVE-2025-22567.md): WordPress TRUSTist REVIEWer Plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, TRUSTist REVIEWer)
- [CVE-2025-22568](https://cve.now/CVE-2025-22568.md): WordPress Post And Page Reactions Plugin \<= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, arete-it Post And Page Reactions)
- [CVE-2025-22569](https://cve.now/CVE-2025-22569.md): WordPress Featured Page Widget Plugin \<= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, GrandSlambert Featured Page Widget)
- [CVE-2025-22570](https://cve.now/CVE-2025-22570.md): WordPress Inline Tweets plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mdjekic Inline Tweets)
- [CVE-2025-22576](https://cve.now/CVE-2025-22576.md): WordPress Site PIN Plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Marcus Downing Site PIN)
- [CVE-2025-22583](https://cve.now/CVE-2025-22583.md): WordPress Scan External Links Plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, anshulsojatia Scan External Links)
- [CVE-2025-22586](https://cve.now/CVE-2025-22586.md): WordPress WPEX Replace DB Urls Plugin \<= 0.4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dstoever WPEX Replace DB Urls)
- [CVE-2025-22588](https://cve.now/CVE-2025-22588.md): WordPress Scanventory Plugin \<= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, intelligence\_lab Scanventory)
- [CVE-2025-22777](https://cve.now/CVE-2025-22777.md): WordPress GiveWP Plugin \<= 3.19.3 - PHP Object Injection vulnerability (CVSS 9.8, StellarWP GiveWP)
- [CVE-2025-22828](https://cve.now/CVE-2025-22828.md): Apache CloudStack: Unauthorised access to annotations (CVSS 4.3, Apache Software Foundation Apache CloudStack)
- [CVE-2024-52938](https://cve.now/CVE-2024-52938.md): GPU DDK - rgxfw\_pm\_add\_freelist\_for\_reconstruction OOB write (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2024-52937](https://cve.now/CVE-2024-52937.md): GPU DDK - rgxfw\_kernel\_CMD\_DISABLE\_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStore (CVSS 6.7, Imagination Technologies Graphics DDK)
- [CVE-2024-52936](https://cve.now/CVE-2024-52936.md): GPU DDK - rgxfw\_hwperf\_config OOB read & write (CVSS 4.4, Imagination Technologies Graphics DDK)
- [CVE-2024-52935](https://cve.now/CVE-2024-52935.md): GPU DDK - psContext-\>eDM gives OOB write (CVSS 4.1, Imagination Technologies Graphics DDK)
- [CVE-2024-47895](https://cve.now/CVE-2024-47895.md): GPU DDK - OOB read into fwlog due to unchecked block count (CVSS 7.1, Imagination Technologies Graphics DDK)
- [CVE-2024-47894](https://cve.now/CVE-2024-47894.md): GPU DDK - Out of bounds read into fwlog due to unchecked loop bounds (CVSS 7.1, Imagination Technologies Graphics DDK)
- [CVE-2024-47897](https://cve.now/CVE-2024-47897.md): GPU DDK - PVRSRVRGXGetEnabledHWPerfBlocksKM off-by-one OOB write (CVSS 8.8, Imagination Technologies Graphics DDK)
- [CVE-2024-12568](https://cve.now/CVE-2024-12568.md): Email Subscribers \< 5.7.45 - Admin+ Stored XSS (CVSS 4.8, Email Subscribers by Icegram Express)
- [CVE-2024-12567](https://cve.now/CVE-2024-12567.md): Email Subscribers \< 5.7.45 - Admin+ Stored XSS (CVSS 4.8, Email Subscribers by Icegram Express)
- [CVE-2024-12566](https://cve.now/CVE-2024-12566.md): Email Subscribers \< 5.7.45 - Admin+ Stored XSS (CVSS 4.8, Email Subscribers by Icegram Express)
- [CVE-2024-12274](https://cve.now/CVE-2024-12274.md): BookingPress \< 1.1.23 - Unauthenticated Export File Download (CVSS 7.5, Appointment Booking Calendar Plugin and Scheduling Plugin)
- [CVE-2024-11636](https://cve.now/CVE-2024-11636.md): Email Subscribers \< 5.7.45 - Admin+ Stored XSS (CVSS 4.8, Email Subscribers by Icegram Express)
- [CVE-2025-0412](https://cve.now/CVE-2025-0412.md): Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Luxion KeyShot Viewer)
- [CVE-2025-0410](https://cve.now/CVE-2025-0410.md): liujianview gymxmjpa MenberConntroller.java MenberDaoInpl sql injection (CVSS 5.3, liujianview gymxmjpa)
- [CVE-2025-0409](https://cve.now/CVE-2025-0409.md): liujianview gymxmjpa MembertypeController.java MembertypeDaoImpl sql injection (CVSS 5.3, liujianview gymxmjpa)
- [CVE-2025-0408](https://cve.now/CVE-2025-0408.md): liujianview gymxmjpa LoosController.java LoosDaoImpl sql injection (CVSS 5.3, liujianview gymxmjpa)
- [CVE-2025-0407](https://cve.now/CVE-2025-0407.md): liujianview gymxmjpa EquipmentController.java EquipmentDaoImpl sql injection (CVSS 5.3, liujianview gymxmjpa)
- [CVE-2025-0406](https://cve.now/CVE-2025-0406.md): liujianview gymxmjpa SubjectController.java SubjectDaoImpl sql injection (CVSS 5.3, liujianview gymxmjpa)
- [CVE-2025-0405](https://cve.now/CVE-2025-0405.md): liujianview gymxmjpa GoodsController.java GoodsDaoImpl sql injection (CVSS 5.3, liujianview gymxmjpa)
- [CVE-2025-0404](https://cve.now/CVE-2025-0404.md): liujianview gymxmjpa CoachController.java CoachController sql injection (CVSS 5.3, liujianview gymxmjpa)
- [CVE-2025-0403](https://cve.now/CVE-2025-0403.md): 1902756969 reggie Phone Number Validation sendMsg information disclosure (CVSS 6.9, 1902756969 reggie)
- [CVE-2023-42225](https://cve.now/CVE-2023-42225.md): Pat Infinite Solutions HelpdeskAdvanced \<= 11.0.33 is vulnerable to Directory Traversal via the Attachment/DownloadTempFile function. (CVSS 7.5)
- [CVE-2023-42226](https://cve.now/CVE-2023-42226.md): Pat Infinite Solutions HelpdeskAdvanced \<= 11.0.33 is vulnerable to Directory Traversal via Email/SaveAttachment function. (CVSS 7.5)
- [CVE-2023-42227](https://cve.now/CVE-2023-42227.md): Pat Infinite Solutions HelpdeskAdvanced \<= 11.0.33 is vulnerable to Directory Traversal via the WSCView/Save function. (CVSS 7.5)
- [CVE-2023-42228](https://cve.now/CVE-2023-42228.md): Pat Infinite Solutions HelpdeskAdvanced \<= 11.0.33 is vulnerable to Incorrect Access Control. (CVSS 8.8)
- [CVE-2023-42229](https://cve.now/CVE-2023-42229.md): Pat Infinite Solutions HelpdeskAdvanced \<= 11.0.33 is vulnerable to Directory Traversal. (CVSS 6.5)
- [CVE-2023-42230](https://cve.now/CVE-2023-42230.md): Pat Infinite Solutions HelpdeskAdvanced \<= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the WSCView/Save function. (CVSS 6.1)
- [CVE-2023-42231](https://cve.now/CVE-2023-42231.md): Pat Infinite Solutions HelpdeskAdvanced \<= 11.0.33 is vulnerable to Incorrect Access Control. (CVSS 8.1)
- [CVE-2023-42232](https://cve.now/CVE-2023-42232.md): Pat Infinite Solutions HelpdeskAdvanced \<= 11.0.33 is vulnerable to Directory Traversal via the Navigator/Index function. (CVSS 7.5)
- [CVE-2023-42233](https://cve.now/CVE-2023-42233.md): Pat Infinite Solutions HelpdeskAdvanced \<= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the Filter/FilterEditor function. (CVSS 6.1)
- [CVE-2023-42234](https://cve.now/CVE-2023-42234.md): Pat Infinite Solutions HelpdeskAdvanced \<= 11.0.33 is vulnerable to Cross Site Request Forgery (CSRF) via the WSCView function. (CVSS 5.4)
- [CVE-2023-42235](https://cve.now/CVE-2023-42235.md): An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. (CVSS 3.8)
- [CVE-2023-42236](https://cve.now/CVE-2023-42236.md): An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. (CVSS 3.8)
- [CVE-2023-42237](https://cve.now/CVE-2023-42237.md): An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. (CVSS 3.8)
- [CVE-2023-42238](https://cve.now/CVE-2023-42238.md): An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. (CVSS 3.8)
- [CVE-2023-42239](https://cve.now/CVE-2023-42239.md): An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. (CVSS 3.8)
- [CVE-2023-42240](https://cve.now/CVE-2023-42240.md): An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. (CVSS 3.8)
- [CVE-2023-42241](https://cve.now/CVE-2023-42241.md): An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. (CVSS 3.8)
- [CVE-2023-42242](https://cve.now/CVE-2023-42242.md): An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. (CVSS 3.8)
- [CVE-2023-42243](https://cve.now/CVE-2023-42243.md): In Selesta Visual Access Manager \< 4.42.2, an authenticated user can access the administrative page /common/vam\_Sql.php, which allows for ar (CVSS 5.4)
- [CVE-2023-42244](https://cve.now/CVE-2023-42244.md): An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. (CVSS 8.8)
- [CVE-2023-42245](https://cve.now/CVE-2023-42245.md): Selesta Visual Access Manager \< 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s\_scheduledfile.php. (CVSS 6.1)
- [CVE-2023-42246](https://cve.now/CVE-2023-42246.md): Selesta Visual Access Manager \< 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /vam/vam\_ep.php. (CVSS 6.1)
- [CVE-2023-42247](https://cve.now/CVE-2023-42247.md): Selesta Visual Access Manager \< 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s\_monitor\_map.php. (CVSS 6.1)
- [CVE-2023-42248](https://cve.now/CVE-2023-42248.md): An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. (CVSS 6.5)
- [CVE-2023-42249](https://cve.now/CVE-2023-42249.md): Selesta Visual Access Manager \< 4.42.2 is vulnerable to Cross Site Scripting (XSS) via vam/vam\_visits.php. (CVSS 6.1)
- [CVE-2023-42250](https://cve.now/CVE-2023-42250.md): Selesta Visual Access Manager \< 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /common/autocomplete.php. (CVSS 6.1)
- [CVE-2024-44771](https://cve.now/CVE-2024-44771.md): BigId PrivacyPortal v179 is vulnerable to Cross Site Scripting (XSS) via the "Label" field in the Report template function. (CVSS 6.1)
- [CVE-2024-46310](https://cve.now/CVE-2024-46310.md): Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via expose (CVSS 9.1)
- [CVE-2024-46479](https://cve.now/CVE-2024-46479.md): Venki Supravizio BPM through 18.0.1 was discovered to contain an arbitrary file upload vulnerability. (CVSS 9.9, Venki Supravizio BPM)
- [CVE-2024-46480](https://cve.now/CVE-2024-46480.md): An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate priv (CVSS 8.4, Venki Supravizio BPM)
- [CVE-2024-46481](https://cve.now/CVE-2024-46481.md): The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS. (CVSS 7.2, Venki Supravizio BPM)
- [CVE-2024-46919](https://cve.now/CVE-2024-46919.md): An issue was discovered in Samsung Mobile Processor Exynos 9820, 9825, 980, 990, 850, 1080, 2100, and 1280. (CVSS 5.3)
- [CVE-2024-46920](https://cve.now/CVE-2024-46920.md): An issue was discovered in Samsung Mobile Processor Exynos 9820, 9825, 980, 990, 850, 1080, 2100, and 1280. (CVSS 6.5)
- [CVE-2024-46921](https://cve.now/CVE-2024-46921.md): An issue was discovered in Samsung Mobile Processor and Modem Exynos 9820, 9825, 980, 990, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9 (CVSS 6.5)
- [CVE-2024-48883](https://cve.now/CVE-2024-48883.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, (CVSS 4.3)
- [CVE-2024-54999](https://cve.now/CVE-2024-54999.md): MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last\_name parameter the General Information module. (CVSS 6.5)
- [CVE-2024-57487](https://cve.now/CVE-2024-57487.md): In Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker (CVSS 6.5)
- [CVE-2024-57488](https://cve.now/CVE-2024-57488.md): Code-Projects Online Car Rental System 1.0 is vulnerable to Cross Site Scripting (XSS) via the vehicalorcview parameter in /admin/edit-vehic (CVSS 6.5)
- [CVE-2024-57811](https://cve.now/CVE-2024-57811.md): In Eaton X303 3.5.16 - X303 3.5.17 Build 712, an attacker with network access to a XC-303 PLC can login as root over SSH. (CVSS 9.1)
- [CVE-2025-22963](https://cve.now/CVE-2025-22963.md): Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin. (CVSS 7.5, Sismics Teedy)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.