# CVEs published 2025-01-26

21 CVEs were published on January 26, 2025: 0 critical, 8 high. Days are UTC.

- [CVE-2025-0722](https://cve.now/CVE-2025-0722.md): needyamin image\_gallery Cover Image gallery.php unrestricted upload (CVSS 5.1, needyamin image\_gallery)
- [CVE-2025-0721](https://cve.now/CVE-2025-0721.md): needyamin image\_gallery view.php cross site scripting (CVSS 5.3, needyamin image\_gallery)
- [CVE-2025-0720](https://cve.now/CVE-2025-0720.md): Microword eScan Antivirus Folder Watch List rtscanner removeExtraSlashes stack-based overflow (CVSS 4.8, Microword eScan Antivirus)
- [CVE-2017-20196](https://cve.now/CVE-2017-20196.md): Itechscripts School Management Software notice-edit.php sql injection (CVSS 5.3, Itechscripts School Management Software)
- [CVE-2023-38009](https://cve.now/CVE-2023-38009.md): IBM Cognos Analytics Mobile information disclosure (CVSS 4.2, IBM Cognos Analytics Mobile)
- [CVE-2023-50946](https://cve.now/CVE-2023-50946.md): IBM Common Licensing information disclosure (CVSS 6.5, IBM Common Licensing)
- [CVE-2023-50945](https://cve.now/CVE-2023-50945.md): IBM Common Licensing information disclosure (CVSS 6.2, IBM Common Licensing)
- [CVE-2024-31906](https://cve.now/CVE-2024-31906.md): IBM Automation Decision Services information disclosure (CVSS 6.2, IBM Automation Decision Services)
- [CVE-2024-13505](https://cve.now/CVE-2024-13505.md): Survey Maker \<= 5.1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey Question (CVSS 5.5, ays-pro Survey Maker)
- [CVE-2024-12334](https://cve.now/CVE-2024-12334.md): WC Affiliate – A Complete WooCommerce Affiliate Plugin \<= 2.4 - Reflected Cross-Site Scripting (CVSS 6.1, codexpert WC Affiliate – WooCommerce Affiliate Plugin)
- [CVE-2024-11641](https://cve.now/CVE-2024-11641.md): VikBooking Hotel Booking Engine & PMS \<= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, e4jvikwp VikBooking Hotel Booking Engine & PMS)
- [CVE-2024-11936](https://cve.now/CVE-2024-11936.md): Zox News \<= 3.16.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, MVPThemes Zox News)
- [CVE-2024-10705](https://cve.now/CVE-2024-10705.md): Multiple Page Generator Plugin – MPG \<= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrl (CVSS 5.4, themeisle Multiple Page Generator Plugin – MPG)
- [CVE-2024-11090](https://cve.now/CVE-2024-11090.md): Membership Plugin – Restrict Content \<= 3.2.13 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3, stellarwp Membership Plugin – Restrict Content)
- [CVE-2024-10633](https://cve.now/CVE-2024-10633.md): Quiz Maker Business, Developer, and Agency \<= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content (CVSS 7.3, AYS Pro Plugins Quiz Maker Developer · AYS Pro Plugins Q… +1)
- [CVE-2024-10574](https://cve.now/CVE-2024-10574.md): Quiz Maker Business, Developer, and Agency \<= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting (CVSS 7.2, AYS Pro Plugins Quiz Maker Developer · AYS Pro Plugins Q… +1)
- [CVE-2024-10628](https://cve.now/CVE-2024-10628.md): Quiz Maker Business, Developer, and Agency \<= (Multiple Versions) - Unauthenticated SQL Injection via id (CVSS 7.5, AYS Pro Plugins Quiz Maker Business · AYS Pro Plugins Qu… +1)
- [CVE-2024-10636](https://cve.now/CVE-2024-10636.md): Quiz Maker Business, Developer, and Agency \<= (Multiple Versions) - Reflected DOM-Based Cross-Site Scripting via content (CVSS 6.1, AYS Pro Plugins Quiz Maker Developer · AYS Pro Plugins Q… +1)
- [CVE-2022-49043](https://cve.now/CVE-2022-49043.md): xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. (CVSS 8.1, xmlsoft libxml2)
- [CVE-2024-46881](https://cve.now/CVE-2024-46881.md): Develocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. (CVSS 7.1, Gradle Enterprise)
- [CVE-2025-24858](https://cve.now/CVE-2025-24858.md): Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashe (CVSS 8.3, Gradle Enterprise)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.