CVEs published January 25, 2025
50 CVEs were published on January 25, 2025: 1 critical, 7 high. 1 is now in CISA KEV.
- Published
- 50
- Critical
- 1
- High
- 7
- Medium
- 41
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 5
Most affected products
- IBM Cloud Pak System
- 6
- IBM Control Center
- 4
- IBM Maximo Application Suite
- 4
- Youzify – BuddyPress Community, User Profile, Social Networ…
- 3
- IBM Analytics Content Hub
- 2
- paulrosen ABC Notation
- 2
- 7-Zip
- 1
- arunbasillal Ask Me Anything
- 1
- badhonrocks Divi Carousel Free
- 1
- bitpressadmin Bit Form – Custom Contact Form, Multi Step, C…
- 1
Critical 1
High 7
- CVE-2025-0543G DATA Security Client Local privilege escalationG DATA CyberDefense AG G DATA Security Client
- CVE-2025-0542G DATA Management Server Local privilege escalationG DATA CyberDefense AG G DATA Management Server
- CVE-2024-39750IBM Analytics Content Hub buffer overflowIBM Analytics Content Hub
- CVE-2024-13562Import WP – Export and Import CSV and XML files to WordPress <= 2.14.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directoryjcollings Import WP – Export and Import CSV and XML files t…
- CVE-2024-12600Custom Product Tabs Lite for WooCommerce <= 1.9.0 - Authenticated (Shop Manager+) PHP Object Injectionskyverge Custom Product Tabs Lite for WooCommerce
- CVE-2025-0682ThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via ShortcodeThemeREX Addons
- CVE-2025-04117-Zip Mark-of-the-Web Bypass Vulnerability7-Zip
Medium, low and unrated 42
- CVE-2024-35150IBM Maximo Application Suite log manipulationIBM Maximo Application Suite
- CVE-2024-35148IBM Maximo Application Suite SQL injectionIBM Maximo Application Suite
- CVE-2024-35144IBM Maximo Application Suite information disclosureIBM Maximo Application Suite
- CVE-2024-35145IBM Maximo Application Suite cross-site scriptingIBM Maximo Application Suite
- CVE-2024-35134IBM Analytics Content Hub information disclosureIBM Analytics Content Hub
- CVE-2023-38271IBM Cloud Pak System information disclosureIBM Cloud Pak System
- CVE-2023-38713IBM Cloud Pak System information disclosureIBM Cloud Pak System
- CVE-2023-38714IBM Cloud Pak System information disclosureIBM Cloud Pak System
- CVE-2023-38013IBM Cloud Pak System information disclosureIBM Cloud Pak System
- CVE-2023-38012IBM Cloud Pak System directory traversalIBM Cloud Pak System
- CVE-2023-38716IBM Cloud Pak System information disclosureIBM Cloud Pak System
- CVE-2024-35114IBM Control Center information disclosureIBM Control Center
- CVE-2024-35113IBM Control Center information disclosureIBM Control Center
- CVE-2024-35112IBM Control Center cross-site scriptingIBM Control Center
- CVE-2024-35111IBM Control Center information disclosureIBM Control Center
- CVE-2025-0350Divi Carousel Lite <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Logo Carousel Widgetsbadhonrocks Divi Carousel Free
- CVE-2024-13450Contact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgerybitpressadmin Bit Form – Custom Contact Form, Multi Step, C…
- CVE-2024-13449Boom Fest <= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updateibsofts Boom Fest
- CVE-2024-12826GoHero Store Customizer for WooCommerce <= 3.5 - Missing Authorization to Unuthenticated Settings Updatenmedia GoHero Store Customizer for WooCommerce
- CVE-2024-13370Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_license)Youzify – BuddyPress Community, User Profile, Social Networ…
- CVE-2024-13550ABC Notation <= 6.1.3 - Authenticated (Contributor+) Arbitrary File Readpaulrosen ABC Notation
- CVE-2024-13551ABC Notation <= 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingpaulrosen ABC Notation
- CVE-2024-13441Bilingual Linker <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingjackdewey Bilingual Linker
- CVE-2024-12817Etsy Importer <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingcoreymcollins Etsy Importer
- CVE-2024-13586Masy Gallery <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingimdr Masy Gallery
- CVE-2024-13467WP Contact Form7 Email Spam Blocker <= 1.0.0 - Reflected Cross-Site Scriptinghk1993 WP Contact Form7 Email Spam Blocker
- CVE-2024-11825Broadstreet <= 1.51.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via zone Parameterbroadstreetads Broadstreet
- CVE-2024-13368Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options UpdateYouzify – BuddyPress Community, User Profile, Social Networ…
- CVE-2024-12113Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Review DeletionYouzify – BuddyPress Community, User Profile, Social Networ…
- CVE-2024-13458WordPress SEO Friendly Accordion FAQ with AI assisted content generation <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingqchantelnotice WordPress SEO Friendly Accordion FAQ with AI…
- CVE-2024-13599LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Namethimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-13548Power Ups for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingdotrex Power Ups for Elementor
- CVE-2024-12885Connections Business Directory <= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletionshazahm1hotmailcom Connections Business Directory
- CVE-2024-12529brodos.net Onlineshop Plugin <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrodosnet brodos.net Onlineshop Plugin
- CVE-2024-12076Target Video Easy Publish <= 3.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scriptingnebojsadabic Target Video Easy Publish
- CVE-2024-12512Ask Me Anything (Anonymously) <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingarunbasillal Ask Me Anything
- CVE-2024-12816NOTICE BOARD BY TOWKIR <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingmastowkir NOTICE BOARD BY TOWKIR
- CVE-2024-10552Flexmls® IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parametersFlexmls® IDX Plugin
- CVE-2024-13721Plethora Plugins Tabs + Accordions <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchorplethoraplugins Plethora Plugins Tabs + Accordions
- CVE-2024-13709Linear <= 2.8.1 - Cross-Site Request Forgery to Cache Resetlinearoy Linear
- CVE-2025-24361Opening a malicious website while running a Nuxt dev server could allow read-only access to codenuxt · @nuxt/webpack-builder +1
- CVE-2025-24360Opening a malicious website while running a Nuxt dev server could allow read-only access to codenuxt · @nuxt/vite-builder