# CVEs published 2025-01-23

111 CVEs were published on January 23, 2025: 11 critical, 47 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-42718](https://cve.now/CVE-2021-42718.md): Sensitive data unnecessarily returned from authenticated API (CVSS 4.9, Replicated Classic)
- [CVE-2025-0693](https://cve.now/CVE-2025-0693.md): Issue with AWS Sign-in IAM User Login Flow - Possible Username Enumeration (CVSS 5.3, AWS Sign-in IAM Login Flow)
- [CVE-2025-23012](https://cve.now/CVE-2025-23012.md): Fedora Repository fedoraIntCallUser default credentials (CVSS 7.5, Fedora Repository)
- [CVE-2025-23011](https://cve.now/CVE-2025-23011.md): Fedora Repository archive extraction path traversal (CVSS 8.7, Fedora Repository)
- [CVE-2025-24353](https://cve.now/CVE-2025-24353.md): Directus privilege escalation vulnerability using Share feature (CVSS 5.0, directus · @directus/app)
- [CVE-2025-24033](https://cve.now/CVE-2025-24033.md): @fastify/multipart vulnerable to unlimited consumption of resources (CVSS 7.5, fastify-multipart · @fastify/multipart)
- [CVE-2025-24034](https://cve.now/CVE-2025-24034.md): Himmelblau leaks credentials in the debug log (CVSS 3.2, himmelblau-idm himmelblau)
- [CVE-2024-55930](https://cve.now/CVE-2024-55930.md): Weak default folder permissions (CVSS 6.7, Xerox Workplace Suite)
- [CVE-2025-22153](https://cve.now/CVE-2025-22153.md): try/except\* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter (CVSS 7.9, zopefoundation RestrictedPython · restrictedpython)
- [CVE-2024-45672](https://cve.now/CVE-2024-45672.md): IBM Security Verify Bridge data manipulation (CVSS 6.0, IBM Security Verify Bridge)
- [CVE-2024-55929](https://cve.now/CVE-2024-55929.md): Mail spoofing (CVSS 5.3, Xerox Workplace Suite)
- [CVE-2024-55928](https://cve.now/CVE-2024-55928.md): Clear text secrets returned & Remote system secrets in clear text (CVSS 6.5, Xerox Workplace Suite)
- [CVE-2024-55927](https://cve.now/CVE-2024-55927.md): Flawed token generation implementation & Hard-coded key implementation (CVSS 7.6, Xerox Workplace Suite)
- [CVE-2025-23227](https://cve.now/CVE-2025-23227.md): IBM Tivoli Application Dependency Discovery Manager cross-site scripting (CVSS 6.4, IBM Tivoli Application Dependency Discovery Manager)
- [CVE-2024-55926](https://cve.now/CVE-2024-55926.md): Arbitrary file upload, deletion and read through header manipulation (CVSS 7.6, Xerox Workplace Suite)
- [CVE-2024-55925](https://cve.now/CVE-2024-55925.md): API Security bypass through header manipulation (CVSS 7.5, Xerox Workplace Suite)
- [CVE-2024-52327](https://cve.now/CVE-2024-52327.md): ECOVACS lawnmower and vacuum cloud service live video PIN bypass (CVSS 6.0, ECOVACS HOME · ECOVACS cloud service)
- [CVE-2024-12079](https://cve.now/CVE-2024-12079.md): ECOVACS lawnmowers cleartext storage of anti-theft PIN (CVSS 4.8, ECOVACS Unspecified robots)
- [CVE-2024-12078](https://cve.now/CVE-2024-12078.md): ECOVACS lawnmowers and vacuums static BLE GATT encryption key (CVSS 5.3, ECOVACS Unspecified robots)
- [CVE-2024-11147](https://cve.now/CVE-2024-11147.md): ECOVACS lawnmowers and vacuums deterministic root password (CVSS 7.6, ECOVACS Unspecified robots)
- [CVE-2024-52331](https://cve.now/CVE-2024-52331.md): ECOVACS lawnmowers and vacuums deterministic firmware encryption key (CVSS 7.5, ECOVACS Unspecified robots)
- [CVE-2024-52330](https://cve.now/CVE-2024-52330.md): ECOVACS lawnmowers and vacuums do not properly validate TLS certificates (CVSS 7.4, ECOVACS DEEBOT X5 PRO PLUS · ECOVACS DEEBOT X5 PRO +13)
- [CVE-2024-52329](https://cve.now/CVE-2024-52329.md): ECOVACS HOME mobile app plugins do not properly validate TLS certificates (CVSS 9.5, ECOVACS HOME)
- [CVE-2024-52328](https://cve.now/CVE-2024-52328.md): ECOVACS lawnmowers and vacuums insecurely store audio warning files (CVSS 1.8, ECOVACS Unspecified robots)
- [CVE-2025-0650](https://cve.now/CVE-2025-0650.md): Ovn: egress acls may be bypassed via specially crafted udp packet (CVSS 8.1, ovn · Fast Datapath for Red Hat Enterprise Linux +1)
- [CVE-2024-52325](https://cve.now/CVE-2024-52325.md): ECOVACS robot lawnmowers and vacuums command injection (CVSS 5.8, ECOVACS GOAT G1 · ECOVACS GOAT G1-800 +8)
- [CVE-2025-23960](https://cve.now/CVE-2025-23960.md): WordPress Save & Import Image from URL Plugin \<= 0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, basteln3rk Save & Import Image from URL)
- [CVE-2025-23894](https://cve.now/CVE-2025-23894.md): WordPress wp-flickr-press Plugin \<= 2.6.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tatsuya wp-flickr-press)
- [CVE-2025-23836](https://cve.now/CVE-2025-23836.md): WordPress Custom Coming Soon Plugin \<= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SuryaBhan Custom Coming Soon)
- [CVE-2025-23835](https://cve.now/CVE-2025-23835.md): WordPress Legal + Plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jmraya Legal +)
- [CVE-2025-23834](https://cve.now/CVE-2025-23834.md): WordPress Links/Problem Reporter plugin \<= 2.6.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RaminMT Links/Problem Reporter)
- [CVE-2025-23733](https://cve.now/CVE-2025-23733.md): WordPress SC Simple Zazzle plugin \<= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sayoko SC Simple Zazzle)
- [CVE-2025-23730](https://cve.now/CVE-2025-23730.md): WordPress FLX Dashboard Groups plugin \<= 0.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, flx0 FLX Dashboard Groups)
- [CVE-2025-23729](https://cve.now/CVE-2025-23729.md): WordPress XTRA Settings plugin \<= 2.1.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fures XTRA Settings)
- [CVE-2025-23727](https://cve.now/CVE-2025-23727.md): WordPress AZ Content Finder plugin \<= 0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, antonzaroutski AZ Content Finder)
- [CVE-2025-23725](https://cve.now/CVE-2025-23725.md): WordPress Accessibility Task Manager plugin \<= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, pshikli Accessibility Task Manager)
- [CVE-2025-23724](https://cve.now/CVE-2025-23724.md): WordPress University Quizzes Online plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, oleksandr87 University Quizzes Online)
- [CVE-2025-23723](https://cve.now/CVE-2025-23723.md): WordPress Plestar Directory Listing plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, hdw player Plestar Directory Listing)
- [CVE-2025-23722](https://cve.now/CVE-2025-23722.md): WordPress Mind3doM RyeBread Widgets plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mind3doM RyeBread Widgets)
- [CVE-2025-23636](https://cve.now/CVE-2025-23636.md): WordPress My Favorite Car plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dimitar A. My Favorite Car)
- [CVE-2025-23634](https://cve.now/CVE-2025-23634.md): WordPress Youtube Video Grid plugin \<= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, codehandling Youtube Video Grid)
- [CVE-2025-23629](https://cve.now/CVE-2025-23629.md): WordPress Gallerio plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Subhasis Laha Gallerio)
- [CVE-2025-23628](https://cve.now/CVE-2025-23628.md): WordPress GeoDigs plugin \<= 3.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NewMediaOne GeoDigs)
- [CVE-2025-23626](https://cve.now/CVE-2025-23626.md): WordPress Kumihimo plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fukushima Kumihimo)
- [CVE-2025-23624](https://cve.now/CVE-2025-23624.md): WordPress WpDevTool plugin \<= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Alessandro Benoit WpDevTool)
- [CVE-2025-23545](https://cve.now/CVE-2025-23545.md): WordPress WP Social Broadcast plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Navnish Bhardwaj WP Social Broadcast)
- [CVE-2025-23544](https://cve.now/CVE-2025-23544.md): WordPress StatPressCN plugin \<= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, heart5 StatPressCN)
- [CVE-2025-23541](https://cve.now/CVE-2025-23541.md): WordPress Download, Downloads plugin \<= 1.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, edmon.parker Download, Downloads)
- [CVE-2025-22768](https://cve.now/CVE-2025-22768.md): WordPress Rocket Media Library Mime Type plugin \<= 2.1.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, JinHan Park Rocket Media Library Mime Type)
- [CVE-2025-22264](https://cve.now/CVE-2025-22264.md): WordPress WP Query Creator plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Patel WP Query Creator)
- [CVE-2025-0637](https://cve.now/CVE-2025-0637.md): Inadequate access control in Beta10 (CVSS 9.8, Beta10)
- [CVE-2024-10846](https://cve.now/CVE-2024-10846.md): Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop (CVSS 5.9, compose-spec compose-go · github.com/compose-spec/compose-g…)
- [CVE-2025-23540](https://cve.now/CVE-2025-23540.md): WordPress WP Front-end login and register plugin \<= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mohsin Khan WP Front-end login and register)
- [CVE-2024-57947](https://cve.now/CVE-2024-57947.md): netfilter: nf\_set\_pipapo: fix initial map fill (CVSS 9.8, Linux)
- [CVE-2024-10539](https://cve.now/CVE-2024-10539.md): Reflected XSS in Uyumsoft's ERP (CVSS 5.5, Uyumsoft Informatin Systems Uyumsoft ERP)
- [CVE-2025-23006](https://cve.now/CVE-2025-23006.md): Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and (CVSS 9.8, KEV, SonicWall SMA1000)
- [CVE-2024-13340](https://cve.now/CVE-2024-13340.md): MDTF – Meta Data and Taxonomies Filter \<= 1.3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, realmag777 MDTF – Meta Data and Taxonomies Filter)
- [CVE-2024-12118](https://cve.now/CVE-2024-12118.md): The Events Calendar \<= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, stellarwp The Events Calendar)
- [CVE-2024-13389](https://cve.now/CVE-2024-13389.md): Cliptakes \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Cliptakes)
- [CVE-2024-13422](https://cve.now/CVE-2024-13422.md): SEO Blogger to WordPress Migration using 301 Redirection \<= 0.4.8 - Reflected Cross-Site Scripting (CVSS 6.1, suhas93 SEO Blogger to WordPress Migration using 301 Redire…)
- [CVE-2024-13236](https://cve.now/CVE-2024-13236.md): Tainacan \<= 0.21.12 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, Tainacan)
- [CVE-2024-12504](https://cve.now/CVE-2024-12504.md): Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP \<= 6.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, videowhisper Broadcast Live Video – Live Streaming : WebRTC…)
- [CVE-2024-13234](https://cve.now/CVE-2024-13234.md): Product Table by WBW \<= 2.1.2 - Unuthenticated SQL Injection (CVSS 7.5, woobewoo Product Table for WooCommerce by WBW)
- [CVE-2024-12043](https://cve.now/CVE-2024-12043.md): Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) \<= 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bdthemes Prime Slider – Addons for Elementor)
- [CVE-2025-0635](https://cve.now/CVE-2025-0635.md): Denial of Service condition in M-Files Server (CVSS 6.3, M-Files Server)
- [CVE-2025-0619](https://cve.now/CVE-2025-0619.md): Unsafe stored password recovery (CVSS 4.6, M-Files Server)
- [CVE-2025-0648](https://cve.now/CVE-2025-0648.md): M-Files Server crash via EOT database driver configuration (CVSS 5.9, M-Files Server)
- [CVE-2024-43708](https://cve.now/CVE-2024-43708.md): An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of i (CVSS 6.5, Elastic Kibana)
- [CVE-2024-12957](https://cve.now/CVE-2024-12957.md): A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. (CVSS 8.4, ASUS Armoury Crate)
- [CVE-2024-13593](https://cve.now/CVE-2024-13593.md): BMLT Meeting Map \<= 2.6.0 - Authenticated (Contributor+) Local File Inclusion (CVSS 7.5, otrok7 BMLT Meeting Map)
- [CVE-2024-13511](https://cve.now/CVE-2024-13511.md): Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset (CVSS 4.3, themehunk Variation Swatches for WooCommerce)
- [CVE-2024-53299](https://cve.now/CVE-2024-53299.md): Apache Wicket: An attacker can intentionally trigger a memory leak (CVSS 6.5, Apache Software Foundation Apache Wicket · org.apache.wicke…)
- [CVE-2024-52975](https://cve.now/CVE-2024-52975.md): Fleet Server sensitive information exposure via logs (CVSS 9.0, Elastic Fleet Server)
- [CVE-2024-52972](https://cve.now/CVE-2024-52972.md): Kibana allocation of resources without limits or throttling leads to crash (CVSS 6.5, Elastic Kibana)
- [CVE-2024-43707](https://cve.now/CVE-2024-43707.md): Kibana exposure of sensitive information to an unauthorized actor (CVSS 7.7, Elastic Kibana)
- [CVE-2024-43710](https://cve.now/CVE-2024-43710.md): Kibana server-side request forgery (CVSS 4.3, Elastic Kibana)
- [CVE-2025-24030](https://cve.now/CVE-2025-24030.md): Envoy Admin Interface Exposed through prometheus metrics endpoint (CVSS 7.1, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2024-42187](https://cve.now/CVE-2024-42187.md): HCL BigFix Patch Download Plug-ins are affected by path traversal vulnerability (CVSS 5.3, HCL Software BigFix Patch Management Download Plug-ins)
- [CVE-2024-42186](https://cve.now/CVE-2024-42186.md): HCL BigFix Patch Download Plug-ins are affected by an insecure protocol support (CVSS 2.8, HCL Software BigFix Patch Management Download Plug-ins)
- [CVE-2023-50309](https://cve.now/CVE-2023-50309.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 6.4, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2023-32340](https://cve.now/CVE-2023-32340.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 4.6, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2024-42185](https://cve.now/CVE-2024-42185.md): HCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks (CVSS 2.5, HCL Software BigFix Patch Management Download Plug-ins)
- [CVE-2024-42184](https://cve.now/CVE-2024-42184.md): HCL BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme (CVSS 2.5, HCL Software BigFix Patch Management Download Plug-ins)
- [CVE-2024-42183](https://cve.now/CVE-2024-42183.md): HCL BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability (CVSS 2.5, HCL Software BigFix Patch Management Download Plug-ins)
- [CVE-2024-42182](https://cve.now/CVE-2024-42182.md): HCL BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability (CVSS 2.5, HCL Software BigFix Patch Management Download Plug-ins)
- [CVE-2023-46400](https://cve.now/CVE-2023-46400.md): KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function. (CVSS 4.3)
- [CVE-2023-46401](https://cve.now/CVE-2023-46401.md): KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function. (CVSS 8.8)
- [CVE-2024-50664](https://cve.now/CVE-2024-50664.md): gpac 2.4 contains a heap-buffer-overflow at isomedia/sample\_descs.c:1799 in gf\_isom\_new\_mpha\_description in gpac/MP4Box. (CVSS 7.8)
- [CVE-2024-50665](https://cve.now/CVE-2024-50665.md): gpac 2.4 contains a SEGV at src/isomedia/drm\_sample.c:1562:96 in isom\_cenc\_get\_sai\_by\_saiz\_saio in MP4Box. (CVSS 5.5)
- [CVE-2024-53379](https://cve.now/CVE-2024-53379.md): Heap buffer overflow in the server site handshake implementation in Real Time Logic LLC's SharkSSL version (from 05/05/24) commit 64808a5e12 (CVSS 7.5)
- [CVE-2024-53588](https://cve.now/CVE-2024-53588.md): A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \\Pro (CVSS 7.8)
- [CVE-2024-53923](https://cve.now/CVE-2024-53923.md): An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. (CVSS 9.1)
- [CVE-2024-55192](https://cve.now/CVE-2024-55192.md): OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO\_v3\_1\_0::farmhash::inlined::Fetch64(char cons (CVSS 9.8)
- [CVE-2024-55193](https://cve.now/CVE-2024-55193.md): OpenImageIO v3.1.0.0dev was discovered to contain a segmentation violation via the component /OpenImageIO/string\_view.h. (CVSS 6.5)
- [CVE-2024-55194](https://cve.now/CVE-2024-55194.md): OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h. (CVSS 9.8)
- [CVE-2024-55195](https://cve.now/CVE-2024-55195.md): An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the progra (CVSS 7.5)
- [CVE-2024-55573](https://cve.now/CVE-2024-55573.md): An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23. (CVSS 9.1)
- [CVE-2024-55971](https://cve.now/CVE-2024-55971.md): SQL Injection vulnerability in the default configuration of the Logitime WebClock application \<= 5.43.0 allows an unauthenticated user to ru (CVSS 10.0)
- [CVE-2024-57326](https://cve.now/CVE-2024-57326.md): A Reflected Cross-Site Scripting (XSS) vulnerability exists in the search.php file of the Online Pizza Delivery System 1.0. (CVSS 6.1)
- [CVE-2024-57328](https://cve.now/CVE-2024-57328.md): A SQL Injection vulnerability exists in the login form of Online Food Ordering System v1.0. (CVSS 9.8)
- [CVE-2024-57329](https://cve.now/CVE-2024-57329.md): HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. (CVSS 5.4)
- [CVE-2024-57386](https://cve.now/CVE-2024-57386.md): Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function. (CVSS 6.1)
- [CVE-2024-57556](https://cve.now/CVE-2024-57556.md): Cross Site Scripting vulnerability in nbubna store v.2.14.2 and before allows a remote attacker to execute arbitrary code via the store.deep (CVSS 6.1, store2)
- [CVE-2024-57719](https://cve.now/CVE-2024-57719.md): lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend\_transformed\_tiled\_argb.isra.0. (CVSS 6.5, lunasvg)
- [CVE-2024-57720](https://cve.now/CVE-2024-57720.md): lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg\_blend. (CVSS 6.5, lunasvg)
- [CVE-2024-57721](https://cve.now/CVE-2024-57721.md): lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg\_path\_add\_path. (CVSS 6.5, lunasvg)
- [CVE-2024-57722](https://cve.now/CVE-2024-57722.md): lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg\_surface\_create. (CVSS 7.5, lunasvg)
- [CVE-2024-57723](https://cve.now/CVE-2024-57723.md): lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition\_source\_over. (CVSS 6.5, lunasvg)
- [CVE-2024-57724](https://cve.now/CVE-2024-57724.md): lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray\_record\_cell. (CVSS 6.5, lunasvg)
- [CVE-2025-24529](https://cve.now/CVE-2025-24529.md): An issue was discovered in phpMyAdmin 5.x before 5.2.2. (CVSS 6.4, phpMyAdmin)
- [CVE-2025-24530](https://cve.now/CVE-2025-24530.md): An issue was discovered in phpMyAdmin 5.x before 5.2.2. (CVSS 6.4, phpMyAdmin · phpmyadmin/phpmyadmin)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.