CVEs published January 26, 2025
21 CVEs were published on January 26, 2025: 0 critical, 8 high.
- Published
- 21
- Critical
- 0
- High
- 8
- Medium
- 13
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- AYS Pro Plugins Quiz Maker Developer · AYS Pro Plugins Q… +1
- 3
- Gradle Enterprise
- 2
- IBM Common Licensing
- 2
- needyamin image_gallery
- 2
- AYS Pro Plugins Quiz Maker Business · AYS Pro Plugins Qu… +1
- 1
- ays-pro Survey Maker
- 1
- codexpert WC Affiliate – WooCommerce Affiliate Plugin
- 1
- e4jvikwp VikBooking Hotel Booking Engine & PMS
- 1
- IBM Automation Decision Services
- 1
- IBM Cognos Analytics Mobile
- 1
High 8
- CVE-2024-11641VikBooking Hotel Booking Engine & PMS <= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Uploade4jvikwp VikBooking Hotel Booking Engine & PMS
- CVE-2024-11936Zox News <= 3.16.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateMVPThemes Zox News
- CVE-2024-10633Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via contentAYS Pro Plugins Quiz Maker Developer · AYS Pro Plugins Q… +1
- CVE-2024-10574Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site ScriptingAYS Pro Plugins Quiz Maker Developer · AYS Pro Plugins Q… +1
- CVE-2024-10628Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via idAYS Pro Plugins Quiz Maker Business · AYS Pro Plugins Qu… +1
- CVE-2022-49043xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.xmlsoft libxml2
- CVE-2024-46881Develocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control.Gradle Enterprise
- CVE-2025-24858Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hasheGradle Enterprise
Medium, low and unrated 13
- CVE-2025-0722needyamin image_gallery Cover Image gallery.php unrestricted uploadneedyamin image_gallery
- CVE-2025-0721needyamin image_gallery view.php cross site scriptingneedyamin image_gallery
- CVE-2025-0720Microword eScan Antivirus Folder Watch List rtscanner removeExtraSlashes stack-based overflowMicroword eScan Antivirus
- CVE-2017-20196Itechscripts School Management Software notice-edit.php sql injectionItechscripts School Management Software
- CVE-2023-38009IBM Cognos Analytics Mobile information disclosureIBM Cognos Analytics Mobile
- CVE-2023-50946IBM Common Licensing information disclosureIBM Common Licensing
- CVE-2023-50945IBM Common Licensing information disclosureIBM Common Licensing
- CVE-2024-31906IBM Automation Decision Services information disclosureIBM Automation Decision Services
- CVE-2024-13505Survey Maker <= 5.1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey Questionays-pro Survey Maker
- CVE-2024-12334WC Affiliate – A Complete WooCommerce Affiliate Plugin <= 2.4 - Reflected Cross-Site Scriptingcodexpert WC Affiliate – WooCommerce Affiliate Plugin
- CVE-2024-10705Multiple Page Generator Plugin – MPG <= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrlthemeisle Multiple Page Generator Plugin – MPG
- CVE-2024-11090Membership Plugin – Restrict Content <= 3.2.13 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposurestellarwp Membership Plugin – Restrict Content
- CVE-2024-10636Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Reflected DOM-Based Cross-Site Scripting via contentAYS Pro Plugins Quiz Maker Developer · AYS Pro Plugins Q… +1