# CVEs published 2025-01-27

242 CVEs were published on January 27, 2025: 29 critical, 61 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-28786](https://cve.now/CVE-2024-28786.md): IBM QRadar SIEM information disclosure (CVSS 6.5, IBM QRadar SIEM)
- [CVE-2022-31749](https://cve.now/CVE-2022-31749.md): Authenticated arbitrary file read/write in WatchGuard Fireware OS (CVSS 6.5, WatchGuard Fireware OS)
- [CVE-2025-24369](https://cve.now/CVE-2025-24369.md): Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0 (CVSS 2.3, Xe x · github.com/Xe/x)
- [CVE-2024-37526](https://cve.now/CVE-2024-37526.md): IBM Watson Query on Cloud Pak for Data information disclosure (CVSS 6.5, IBM Data Virtualization)
- [CVE-2025-24130](https://cve.now/CVE-2025-24130.md): The issue was addressed with improved checks. (CVSS 9.8, Apple macOS)
- [CVE-2024-54519](https://cve.now/CVE-2024-54519.md): The issue was resolved by sanitizing logging. (CVSS 5.5, Apple macOS)
- [CVE-2025-24126](https://cve.now/CVE-2025-24126.md): An input validation issue was addressed. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-54523](https://cve.now/CVE-2024-54523.md): The issue was addressed with improved bounds checks. (CVSS 9.1, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-24096](https://cve.now/CVE-2025-24096.md): This issue was addressed through improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2024-54542](https://cve.now/CVE-2024-54542.md): An authentication issue was addressed with improved state management. (CVSS 9.1, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2025-24106](https://cve.now/CVE-2025-24106.md): This issue was addressed with additional entitlement checks. (CVSS 6.5, Apple macOS)
- [CVE-2024-54539](https://cve.now/CVE-2024-54539.md): This issue was addressed through improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2025-24151](https://cve.now/CVE-2025-24151.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple macOS)
- [CVE-2025-24146](https://cve.now/CVE-2025-24146.md): This issue was addressed with improved redaction of sensitive information. (CVSS 9.8, Apple macOS)
- [CVE-2025-24150](https://cve.now/CVE-2025-24150.md): A privacy issue was addressed with improved handling of files. (CVSS 8.8, Apple Safari · Apple iOS and iPadOS +1)
- [CVE-2025-24107](https://cve.now/CVE-2025-24107.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-54543](https://cve.now/CVE-2024-54543.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple Safari · Apple iOS and iPadOS +5)
- [CVE-2024-54522](https://cve.now/CVE-2024-54522.md): The issue was addressed with improved bounds checks. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-54488](https://cve.now/CVE-2024-54488.md): A logic issue was addressed with improved file handling. (CVSS 5.3, Apple iOS and iPadOS · Apple iPadOS +1)
- [CVE-2024-44172](https://cve.now/CVE-2024-44172.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 3.3, Apple macOS)
- [CVE-2025-24127](https://cve.now/CVE-2025-24127.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +3)
- [CVE-2024-54518](https://cve.now/CVE-2024-54518.md): The issue was addressed with improved bounds checks. (CVSS 5.3, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-24131](https://cve.now/CVE-2025-24131.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple iOS and iPadOS · Apple iPadOS +3)
- [CVE-2025-24086](https://cve.now/CVE-2025-24086.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24100](https://cve.now/CVE-2025-24100.md): A logic issue was addressed with improved restrictions. (CVSS 3.3, Apple macOS)
- [CVE-2025-24141](https://cve.now/CVE-2025-24141.md): An authentication issue was addressed with improved state management. (CVSS 3.3, Apple iOS and iPadOS)
- [CVE-2025-24116](https://cve.now/CVE-2025-24116.md): An access issue was addressed with additional sandbox restrictions. (CVSS 4.4, Apple macOS)
- [CVE-2025-24161](https://cve.now/CVE-2025-24161.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2024-54509](https://cve.now/CVE-2024-54509.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 7.8, Apple macOS)
- [CVE-2025-24136](https://cve.now/CVE-2025-24136.md): This issue was addressed with improved validation of symlinks. (CVSS 4.4, Apple macOS)
- [CVE-2025-24120](https://cve.now/CVE-2025-24120.md): This issue was addressed by improved management of object lifetimes. (CVSS 7.5, Apple macOS)
- [CVE-2025-24177](https://cve.now/CVE-2025-24177.md): A null pointer dereference was addressed with improved input validation. (CVSS 7.5, Apple iOS and iPadOS · Apple iPadOS +1)
- [CVE-2024-54499](https://cve.now/CVE-2024-54499.md): A use-after-free issue was addressed with improved memory management. (CVSS 8.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-24176](https://cve.now/CVE-2025-24176.md): A permissions issue was addressed with improved validation. (CVSS 7.1, Apple macOS)
- [CVE-2024-54549](https://cve.now/CVE-2024-54549.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple macOS)
- [CVE-2025-24121](https://cve.now/CVE-2025-24121.md): A logic issue was addressed with improved checks. (CVSS 3.3, Apple macOS)
- [CVE-2025-24137](https://cve.now/CVE-2025-24137.md): A type confusion issue was addressed with improved checks. (CVSS 8.0, Apple iOS and iPadOS · Apple iPadOS +3)
- [CVE-2025-24160](https://cve.now/CVE-2025-24160.md): The issue was addressed with improved checks. (CVSS 4.3, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24117](https://cve.now/CVE-2025-24117.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +3)
- [CVE-2025-24140](https://cve.now/CVE-2025-24140.md): This issue was addressed through improved state management. (CVSS 5.3, Apple macOS)
- [CVE-2025-24156](https://cve.now/CVE-2025-24156.md): An integer overflow was addressed through improved input validation. (CVSS 8.8, Apple macOS)
- [CVE-2025-24101](https://cve.now/CVE-2025-24101.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple macOS)
- [CVE-2024-54512](https://cve.now/CVE-2024-54512.md): The issue was addressed by removing the relevant flags. (CVSS 9.1, Apple iOS and iPadOS · Apple watchOS)
- [CVE-2025-24087](https://cve.now/CVE-2025-24087.md): The issue was addressed with additional permissions checks. (CVSS 5.5, Apple macOS)
- [CVE-2025-24114](https://cve.now/CVE-2025-24114.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-24143](https://cve.now/CVE-2025-24143.md): The issue was addressed with improved access restrictions to the file system. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2024-54497](https://cve.now/CVE-2024-54497.md): The issue was addressed with improved checks. (CVSS 6.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2024-54478](https://cve.now/CVE-2024-54478.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24102](https://cve.now/CVE-2025-24102.md): The issue was addressed with improved checks. (CVSS 9.8, Apple iPadOS · Apple macOS)
- [CVE-2024-54507](https://cve.now/CVE-2024-54507.md): A type confusion issue was addressed with improved memory handling. (CVSS 9.1, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-24092](https://cve.now/CVE-2025-24092.md): This issue was addressed with improved data protection. (CVSS 5.5, Apple macOS)
- [CVE-2025-24138](https://cve.now/CVE-2025-24138.md): This issue was addressed through improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2024-54550](https://cve.now/CVE-2024-54550.md): This issue was addressed with improved redaction of sensitive information. (CVSS 4.0, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-24118](https://cve.now/CVE-2025-24118.md): The issue was addressed with improved memory handling. (CVSS 9.8, Apple iPadOS · Apple macOS)
- [CVE-2025-24159](https://cve.now/CVE-2025-24159.md): A validation issue was addressed with improved logic. (CVSS 7.8, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24122](https://cve.now/CVE-2025-24122.md): A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-24134](https://cve.now/CVE-2025-24134.md): An information disclosure issue was addressed with improved privacy controls. (CVSS 5.5, Apple macOS)
- [CVE-2025-24163](https://cve.now/CVE-2025-24163.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24162](https://cve.now/CVE-2025-24162.md): This issue was addressed through improved state management. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-24135](https://cve.now/CVE-2025-24135.md): This issue was addressed with improved message validation. (CVSS 7.8, Apple macOS)
- [CVE-2025-24123](https://cve.now/CVE-2025-24123.md): The issue was addressed with improved checks. (CVSS 6.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24174](https://cve.now/CVE-2025-24174.md): The issue was addressed with improved checks. (CVSS 7.7, Apple macOS)
- [CVE-2024-54530](https://cve.now/CVE-2024-54530.md): The issue was addressed with improved checks. (CVSS 9.1, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-54475](https://cve.now/CVE-2024-54475.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 3.3, Apple macOS)
- [CVE-2025-24158](https://cve.now/CVE-2025-24158.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-24093](https://cve.now/CVE-2025-24093.md): A permissions issue was addressed with additional restrictions. (CVSS 9.8, Apple macOS)
- [CVE-2025-24139](https://cve.now/CVE-2025-24139.md): The issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2025-24085](https://cve.now/CVE-2025-24085.md): A use after free issue was addressed with improved memory management. (CVSS 10.0, KEV, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2024-54547](https://cve.now/CVE-2024-54547.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2025-24103](https://cve.now/CVE-2025-24103.md): This issue was addressed with improved validation of symlinks. (CVSS 9.8, Apple macOS)
- [CVE-2025-24154](https://cve.now/CVE-2025-24154.md): An out-of-bounds write was addressed with improved input validation. (CVSS 9.1, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2025-24115](https://cve.now/CVE-2025-24115.md): A path handling issue was addressed with improved validation. (CVSS 5.5, Apple macOS)
- [CVE-2025-24149](https://cve.now/CVE-2025-24149.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24108](https://cve.now/CVE-2025-24108.md): An access issue was addressed with additional sandbox restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2024-54537](https://cve.now/CVE-2024-54537.md): This issue was addressed with additional entitlement checks. (CVSS 7.1, Apple macOS)
- [CVE-2025-24124](https://cve.now/CVE-2025-24124.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2024-54468](https://cve.now/CVE-2024-54468.md): The issue was addressed with improved checks. (CVSS 8.2, Apple iOS and iPadOS · Apple iPadOS +3)
- [CVE-2025-24112](https://cve.now/CVE-2025-24112.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2025-24145](https://cve.now/CVE-2025-24145.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-24153](https://cve.now/CVE-2025-24153.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 6.7, Apple macOS)
- [CVE-2025-24104](https://cve.now/CVE-2025-24104.md): This issue was addressed with improved handling of symlinks. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS)
- [CVE-2024-54517](https://cve.now/CVE-2024-54517.md): The issue was addressed with improved bounds checks. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-24128](https://cve.now/CVE-2025-24128.md): The issue was addressed by adding additional logic. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +1)
- [CVE-2025-24094](https://cve.now/CVE-2025-24094.md): A race condition was addressed with additional validation. (CVSS 4.0, Apple macOS)
- [CVE-2025-24169](https://cve.now/CVE-2025-24169.md): A logging issue was addressed with improved data redaction. (CVSS 7.5, Apple Safari · Apple macOS)
- [CVE-2024-54557](https://cve.now/CVE-2024-54557.md): A logic issue was addressed with improved restrictions. (CVSS 7.5, Apple macOS)
- [CVE-2025-24129](https://cve.now/CVE-2025-24129.md): A type confusion issue was addressed with improved checks. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-54516](https://cve.now/CVE-2024-54516.md): A permissions issue was addressed with additional restrictions. (CVSS 3.3, Apple macOS)
- [CVE-2024-54541](https://cve.now/CVE-2024-54541.md): This issue was addressed through improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-24152](https://cve.now/CVE-2025-24152.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple macOS)
- [CVE-2025-24113](https://cve.now/CVE-2025-24113.md): The issue was addressed with improved UI. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-54536](https://cve.now/CVE-2024-54536.md): The issue was addressed with improved validation of environment variables. (CVSS 5.5, Apple macOS)
- [CVE-2025-24109](https://cve.now/CVE-2025-24109.md): A downgrade issue was addressed with additional code-signing restrictions. (CVSS 9.8, Apple macOS)
- [CVE-2024-54520](https://cve.now/CVE-2024-54520.md): A path handling issue was addressed with improved validation. (CVSS 5.5, Apple macOS)
- [CVE-2025-0753](https://cve.now/CVE-2025-0753.md): Axiomatic Bento4 mp42aac ReadPartial heap-based overflow (CVSS 6.9, Axiomatic Bento4)
- [CVE-2025-0751](https://cve.now/CVE-2025-0751.md): Axiomatic Bento4 mp42aac ReadBits heap-based overflow (CVSS 6.9, Axiomatic Bento4)
- [CVE-2024-48841](https://cve.now/CVE-2024-48841.md): Remote Code Execution (RCE) Vulnerabilities (CVSS 10.0, ABB FLXEON)
- [CVE-2025-0734](https://cve.now/CVE-2025-0734.md): y\_project RuoYi Whitelist getBeanName deserialization (CVSS 5.1, y\_project RuoYi)
- [CVE-2025-0733](https://cve.now/CVE-2025-0733.md): Postman profapi.dll untrusted search path (CVSS 2.0, Postman)
- [CVE-2025-0732](https://cve.now/CVE-2025-0732.md): Discord profapi.dll untrusted search path (CVSS 2.0, Discord)
- [CVE-2025-24365](https://cve.now/CVE-2025-24365.md): vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait (CVSS 8.1, dani-garcia vaultwarden)
- [CVE-2025-24364](https://cve.now/CVE-2025-24364.md): vaultwarden allows RCE in the admin panel (CVSS 7.2, dani-garcia vaultwarden)
- [CVE-2025-24357](https://cve.now/CVE-2025-24357.md): vLLM allows a malicious model RCE by torch.load in hf\_model\_weights\_iterator (CVSS 7.5, vllm-project vllm · vllm)
- [CVE-2025-24356](https://cve.now/CVE-2025-24356.md): UDP traffic amplification via fastd's fast reconnect feature (CVSS 6.9, neocturne fastd)
- [CVE-2025-24354](https://cve.now/CVE-2025-24354.md): imgproxy is vulnerable to SSRF against 0.0.0.0 (CVSS 5.3, imgproxy · github.com/imgproxy/imgproxy +2)
- [CVE-2025-23197](https://cve.now/CVE-2025-23197.md): matrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub support (CVSS 6.5, matrix-org matrix-hookshot)
- [CVE-2024-12740](https://cve.now/CVE-2024-12740.md): Dependency on Vulnerable Third-Party Component exposes Vulnerabilities in NI Vision Software (CVSS 7.8, NI Vision Development Module · NI FlexRIO +5)
- [CVE-2025-24368](https://cve.now/CVE-2025-24368.md): Cacti has a SQL Injection vulnerability when using tree rules through Automation API (CVSS 6.9, cacti)
- [CVE-2025-24367](https://cve.now/CVE-2025-24367.md): Cacti allows Arbitrary File Creation leading to RCE (CVSS 8.7, cacti)
- [CVE-2025-22604](https://cve.now/CVE-2025-22604.md): Cacti has Authenticated RCE via multi-line SNMP responses (CVSS 9.1, cacti)
- [CVE-2024-54145](https://cve.now/CVE-2024-54145.md): Cacti has a SQL Injection vulnerability when request automation devices (CVSS 6.3, cacti)
- [CVE-2024-54146](https://cve.now/CVE-2024-54146.md): Cacti has a SQL Injection vulnerability when view host template (CVSS 7.6, cacti)
- [CVE-2025-0730](https://cve.now/CVE-2025-0730.md): TP-Link TL-SG108E HTTP GET Request usr\_account\_set.cgi get request method with sensitive query strings (CVSS 6.3, TP-Link TL-SG108E)
- [CVE-2025-0729](https://cve.now/CVE-2025-0729.md): TP-Link TL-SG108E clickjacking (CVSS 6.9, TP-Link TL-SG108E)
- [CVE-2024-27256](https://cve.now/CVE-2024-27256.md): IBM MQ Operator information disclosure (CVSS 5.9, IBM MQ Operator)
- [CVE-2023-52292](https://cve.now/CVE-2023-52292.md): IBM Sterling File Gateway cross-site scripting (CVSS 6.4, IBM Sterling File Gateway)
- [CVE-2023-47159](https://cve.now/CVE-2023-47159.md): IBM Sterling File Gateway information disclosure (CVSS 4.3, IBM Sterling File Gateway)
- [CVE-2024-22316](https://cve.now/CVE-2024-22316.md): IBM Sterling File Gateway improper access control (CVSS 4.3, IBM Sterling File Gateway)
- [CVE-2024-37527](https://cve.now/CVE-2024-37527.md): IBM OpenPages with Watson cross-site scripting (CVSS 5.4, IBM OpenPages with Watson)
- [CVE-2024-45598](https://cve.now/CVE-2024-45598.md): Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path (CVSS 6.0, cacti)
- [CVE-2024-38320](https://cve.now/CVE-2024-38320.md): IBM Storage Protect for Virtual Environments: Data Protection for VMware information disclosure (CVSS 5.9, IBM Storage Protect for Virtual Environments: Data Protecti…)
- [CVE-2024-38325](https://cve.now/CVE-2024-38325.md): IBM Storage Defender information disclosure (CVSS 5.9, IBM Storage Defender - Resiliency Service)
- [CVE-2025-24783](https://cve.now/CVE-2025-24783.md): Apache Cocoon: continuations may not be private (CVSS 7.5, Apache Software Foundation Apache Cocoon · org.apache.co… +1)
- [CVE-2025-24782](https://cve.now/CVE-2025-24782.md): WordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin \<= 1.6.10 - Local File Inclusion vulnerability (CVSS 6.5, wpWax Post Grid, Slider & Carousel Ultimate)
- [CVE-2025-23982](https://cve.now/CVE-2025-23982.md): WordPress Fare Calculator plugin \<= 1.1 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, Gopi krishnan Fare Calculator)
- [CVE-2025-24747](https://cve.now/CVE-2025-24747.md): WordPress Houzez theme \<= 3.4.0 - Broken Access Control vulnerability (CVSS 5.3, favethemes Houzez)
- [CVE-2025-24744](https://cve.now/CVE-2025-24744.md): WordPress Bridge Core plugin \<= 3.3 - Broken Access Control vulnerability (CVSS 4.3, NotFound Bridge Core)
- [CVE-2025-24743](https://cve.now/CVE-2025-24743.md): WordPress RomethemeKit For Elementor plugin \<= 1.5.2 - Broken Access Control vulnerability (CVSS 4.3, Rometheme RTMKit)
- [CVE-2025-24742](https://cve.now/CVE-2025-24742.md): WordPress WP Google Maps plugin \<= 9.0.40 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WPGMaps WP Go Maps)
- [CVE-2025-24741](https://cve.now/CVE-2025-24741.md): WordPress KB Support plugin \<= 1.6.7 - Open Redirection vulnerability (CVSS 4.7, LOGON KB Support)
- [CVE-2025-24740](https://cve.now/CVE-2025-24740.md): WordPress Learnpress plugin \<= 4.2.7.1 - Open Redirection vulnerability (CVSS 4.7, ThimPress LearnPress)
- [CVE-2025-24734](https://cve.now/CVE-2025-24734.md): WordPress Better Find and Replace plugin \<= 1.6.7 - Privilege Escalation vulnerability (CVSS 8.8, CodeSolz Better Find and Replace)
- [CVE-2025-24708](https://cve.now/CVE-2025-24708.md): WordPress WP Dynamics CRM plugin \<= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CRM Perks WP Dynamics CRM for Contact Form 7, WPForms, Elem…)
- [CVE-2025-24689](https://cve.now/CVE-2025-24689.md): WordPress Import and export users and customers plugin 1.27.12 - Sensitive Data Exposure vulnerability (CVSS 5.9, Javier Carazo Import and export users and customers)
- [CVE-2025-24680](https://cve.now/CVE-2025-24680.md): WordPress WP Multi Store Locator Plugin \<= 2.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPExperts.io WP Multistore Locator)
- [CVE-2025-24671](https://cve.now/CVE-2025-24671.md): WordPress Save as PDF Plugin by Pdfcrowd Plugin \<= 4.4.0 - PHP Object Injection vulnerability (CVSS 9.8, Pdfcrowd Dev Team Save as PDF)
- [CVE-2025-24667](https://cve.now/CVE-2025-24667.md): WordPress Small Package Quotes Plugin \<= 5.2.17 - SQL Injection vulnerability (CVSS 9.3, enituretechnology Small Package Quotes – Worldwide Express…)
- [CVE-2025-24665](https://cve.now/CVE-2025-24665.md): WordPress Small Package Quotes Plugin \<= 2.4.8 - SQL Injection vulnerability (CVSS 9.3, enituretechnology Small Package Quotes – Unishippers Edition)
- [CVE-2025-24662](https://cve.now/CVE-2025-24662.md): WordPress LearnDash LMS Plugin \<= 4.20.0.1 - Broken Access Control vulnerability (CVSS 5.3, LearnDash LMS)
- [CVE-2025-24653](https://cve.now/CVE-2025-24653.md): WordPress Admin and Site Enhancements (ASE) Pro Plugin \<= 7.6.1.1 - Broken Access Control vulnerability (CVSS 4.3, NotFound Admin and Site Enhancements (ASE) Pro)
- [CVE-2025-24628](https://cve.now/CVE-2025-24628.md): WordPress reCaptcha by BestWebSoft Plugin \<= 1.78 - Captcha Bypass vulnerability (CVSS 5.3, bestwebsoft Google Captcha)
- [CVE-2025-24626](https://cve.now/CVE-2025-24626.md): WordPress Music Store – WordPress eCommerce Plugin \<= 1.1.19 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, codepeople Music Store)
- [CVE-2025-24606](https://cve.now/CVE-2025-24606.md): WordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin \<=20.8.1 - Broken Access Control vulnerability (CVSS 6.4, BoldGrid Client Invoicing by Sprout Invoices)
- [CVE-2025-24603](https://cve.now/CVE-2025-24603.md): WordPress Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin \<= 3.4.10 - Broken Access Control vulnerability (CVSS 4.3, Dmitry V. (CEO of "UKR Solution") Print Barcode Labels for…)
- [CVE-2025-24600](https://cve.now/CVE-2025-24600.md): WordPress RSVPMaker plugin \<= 11.4.5 - Broken Access Control vulnerability (CVSS 5.3, davidfcarr RSVPMarker)
- [CVE-2025-24593](https://cve.now/CVE-2025-24593.md): WordPress Edwiser Bridge plugin \<= 3.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WisdmLabs Edwiser Bridge)
- [CVE-2025-24590](https://cve.now/CVE-2025-24590.md): WordPress picu – Online Photo Proofing Gallery plugin \<= 2.4.0 - Broken Access Control vulnerability (CVSS 5.3, picu)
- [CVE-2025-24540](https://cve.now/CVE-2025-24540.md): WordPress Website Builder by SeedProd plugin \<= 6.18.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Coming Soon Page, Under Construction & Maintenance Mode by…)
- [CVE-2025-24538](https://cve.now/CVE-2025-24538.md): WordPress BuddyPress Groups Extras plugin \<= 3.6.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Slava Abakumov BuddyPress Groups Extras)
- [CVE-2025-24537](https://cve.now/CVE-2025-24537.md): WordPress The Events Calendar plugin \<= 6.7.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, StellarWP The Events Calendar)
- [CVE-2025-23849](https://cve.now/CVE-2025-23849.md): WordPress PAPERCITE plugin \<= 0.5.18 - Broken Access Control vulnerability (CVSS 5.4, bpiwowar PAPERCITE)
- [CVE-2025-23756](https://cve.now/CVE-2025-23756.md): WordPress LawPress plugin \<= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ivanchernyakov LawPress – Law Firm Website Management)
- [CVE-2025-23754](https://cve.now/CVE-2025-23754.md): WordPress The Loops plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ulrich Sossou The Loops)
- [CVE-2025-23752](https://cve.now/CVE-2025-23752.md): WordPress CGD Arrange Terms plugin \<= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Clifton Griffin CGD Arrange Terms)
- [CVE-2025-23669](https://cve.now/CVE-2025-23669.md): WordPress WP Smart Tooltip plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nurul Amin WP Smart Tooltip)
- [CVE-2025-23656](https://cve.now/CVE-2025-23656.md): WordPress Donate visa plugin \<= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Saul Morales Pacheco Donate visa)
- [CVE-2025-23574](https://cve.now/CVE-2025-23574.md): WordPress CubePM plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jonathan Lau CubePM)
- [CVE-2025-23531](https://cve.now/CVE-2025-23531.md): WordPress RSVPMaker Volunteer Roles plugin \<= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, davidfcarr RSVPMaker Volunteer Roles)
- [CVE-2025-23529](https://cve.now/CVE-2025-23529.md): WordPress Minterpress plugin \<= 1.0.5 - Arbitrary Content Deletion vulnerability (CVSS 6.5, blokhauswp Minterpress)
- [CVE-2025-22513](https://cve.now/CVE-2025-22513.md): WordPress Simple Locator Plugin \<= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kyle Phillips Simple Locator)
- [CVE-2025-24754](https://cve.now/CVE-2025-24754.md): WordPress Houzez theme \<= 3.4.0 - Broken Access Control vulnerability (CVSS 4.3, favethemes Houzez)
- [CVE-2025-24685](https://cve.now/CVE-2025-24685.md): WordPress Morkva UA Shipping plugin \<= 1.0.18 - Local File Inclusion vulnerability (CVSS 8.1, Ihor Kit Morkva UA Shipping)
- [CVE-2025-24664](https://cve.now/CVE-2025-24664.md): WordPress LTL Freight Quotes Plugin \<= 5.0.20 - SQL Injection vulnerability (CVSS 9.3, enituretechnology LTL Freight Quotes – Worldwide Express Ed…)
- [CVE-2025-24612](https://cve.now/CVE-2025-24612.md): WordPress Shipping for Nova Poshta plugin \<= 1.19.6 - SQL Injection vulnerability (CVSS 9.3, Ihor Kit Shipping for Nova Poshta)
- [CVE-2025-24601](https://cve.now/CVE-2025-24601.md): WordPress FundPress plugin \<= 2.0.6 - PHP Object Injection vulnerability (CVSS 9.8, ThimPress FundPress)
- [CVE-2025-24584](https://cve.now/CVE-2025-24584.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 2.3.0 - Broken Access Control vulnerability (CVSS 4.3, bdthemes Ultimate Store Kit Elementor Addons)
- [CVE-2025-24533](https://cve.now/CVE-2025-24533.md): WordPress MetaSlider plugin \<= 3.92.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Responsive Slider by MetaSlider)
- [CVE-2025-23792](https://cve.now/CVE-2025-23792.md): WordPress Passwordless WP – Login with your glance or fingerprint Plugin \<= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Busters Passwordless WP – Login with your glance or fing…)
- [CVE-2025-23457](https://cve.now/CVE-2025-23457.md): WordPress Shipdeo plugin \<= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, shipdeoplugin Shipdeo)
- [CVE-2022-4975](https://cve.now/CVE-2022-4975.md): Rhacs: cross-site scripting in portal (CVSS 8.9, Red Hat Advanced Cluster Security)
- [CVE-2024-11348](https://cve.now/CVE-2024-11348.md): Reflected XSS in Eura7 CMSmanager (CVSS 5.3, Eura7 CMSmanager)
- [CVE-2024-55931](https://cve.now/CVE-2024-55931.md): Token stored in session storage (CVSS 6.5, Xerox Workplace Suite)
- [CVE-2025-0696](https://cve.now/CVE-2025-0696.md): A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embe (CVSS 5.3, Cesanta Frozen)
- [CVE-2025-0695](https://cve.now/CVE-2025-0695.md): An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce (CVSS 5.3, Cesanta Frozen)
- [CVE-2024-12345](https://cve.now/CVE-2024-12345.md): INW Krbyyyzo Daily Huddle Site gbo.aspx resource consumption (CVSS 6.7, INW Krbyyyzo)
- [CVE-2025-24814](https://cve.now/CVE-2025-24814.md): Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files (CVSS 5.4, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2024-52012](https://cve.now/CVE-2024-52012.md): Apache Solr: Configset upload on Windows allows arbitrary path write-access (CVSS 5.4, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2024-13117](https://cve.now/CVE-2024-13117.md): Social Share Buttons for WordPress \<= 2.7 - Unauthenticated Image Upload & Path Traversal (CVSS 6.5, Social Share Buttons for WordPress)
- [CVE-2024-13116](https://cve.now/CVE-2024-13116.md): Crelly Slider \< 1.4.7 - Admin+ Stored XSS (CVSS 3.8, Crelly Slider)
- [CVE-2024-13095](https://cve.now/CVE-2024-13095.md): WP Triggers Lite \<= 2.5.3 - Admin+ SQL Injection (CVSS 4.8, WP Triggers Lite)
- [CVE-2024-13094](https://cve.now/CVE-2024-13094.md): WP Triggers Lite \<= 2.5.3 - Reflected XSS (CVSS 7.1, WP Triggers Lite)
- [CVE-2024-13057](https://cve.now/CVE-2024-13057.md): Dyn Business Panel \<= 1.0.0 - Stored XSS via CSRF (CVSS 7.1, Dyn Business Panel)
- [CVE-2024-13056](https://cve.now/CVE-2024-13056.md): Dyn Business Panel \<= 1.0.0 - Reflected XSS (CVSS 7.1, Dyn Business Panel)
- [CVE-2024-13055](https://cve.now/CVE-2024-13055.md): Dyn Business Panel \<= 1.0.0 - Reflected XSS (CVSS 7.1, Dyn Business Panel)
- [CVE-2024-13052](https://cve.now/CVE-2024-13052.md): Dental Optimizer Patient Generator App \<= 1.0 - Reflected XSS (CVSS 7.1, Dental Optimizer Patient Generator App)
- [CVE-2024-12774](https://cve.now/CVE-2024-12774.md): Altra Side Menu \<= 2.0 - Abitrary Menu Deletion via CSRF (CVSS 6.5, Altra Side Menu)
- [CVE-2024-12773](https://cve.now/CVE-2024-12773.md): Altra Side Menu \<= 2.0 - Admin+ SQL Injection (CVSS 7.2, Altra Side Menu)
- [CVE-2024-12436](https://cve.now/CVE-2024-12436.md): WP Customer Area \<= 8.2.4 - Bulk Delete via CSRF (CVSS 4.3, WP Customer Area)
- [CVE-2024-12321](https://cve.now/CVE-2024-12321.md): WC Affiliate \<= 2.3.9 - Reflected XSS (CVSS 7.1, WC Affiliate)
- [CVE-2024-12280](https://cve.now/CVE-2024-12280.md): WP Customer Area \<= 8.2.4 - Event Log Deletion via CSRF (CVSS 4.3, WP Customer Area)
- [CVE-2025-24390](https://cve.now/CVE-2025-24390.md): Missing Cookie Flags (CVSS 6.8, OTRS AG OTRS)
- [CVE-2025-24389](https://cve.now/CVE-2025-24389.md): SMTP Password will be shown in cleartext on some SMTP errors (CVSS 6.3, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2024-43446](https://cve.now/CVE-2024-43446.md): Improper check of permissions in Generic Interface (CVSS 3.5, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2024-43445](https://cve.now/CVE-2024-43445.md): Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing (CVSS 5.4, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2023-46187](https://cve.now/CVE-2023-46187.md): IBM InfoSphere Master Data Management cross-site scripting (CVSS 5.4, IBM InfoSphere Master Data Management)
- [CVE-2024-28766](https://cve.now/CVE-2024-28766.md): IBM Security Directory Integrator information disclosure (CVSS 2.4, IBM Security Directory Integrator · IBM Security Verify Dir…)
- [CVE-2024-28770](https://cve.now/CVE-2024-28770.md): IBM Security Directory Integrator information disclosure (CVSS 4.8, IBM Security Directory Integrator · IBM Security Verify Dir…)
- [CVE-2024-28771](https://cve.now/CVE-2024-28771.md): IBM Security Directory Integrator information disclosure (CVSS 4.8, IBM Security Directory Integrator · IBM Security Verify Dir…)
- [CVE-2024-26317](https://cve.now/CVE-2024-26317.md): In illumos illumos-gate 2024-02-15, an error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinat (CVSS 6.1)
- [CVE-2024-48416](https://cve.now/CVE-2024-48416.md): Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/fromSetLanDhcpsClientbinding. (CVSS 8.8)
- [CVE-2024-48417](https://cve.now/CVE-2024-48417.md): Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Cross Site Scripting (XSS) in : /bin/goahead via /goform/setStaticRou (CVSS 5.2)
- [CVE-2024-48418](https://cve.now/CVE-2024-48418.md): In Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06, the request /goform/fromSetDDNS does not properly handle special characters in any (CVSS 8.8)
- [CVE-2024-48419](https://cve.now/CVE-2024-48419.md): Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. (CVSS 8.8)
- [CVE-2024-48420](https://cve.now/CVE-2024-48420.md): Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/getWifiBasic. (CVSS 8.8)
- [CVE-2024-48662](https://cve.now/CVE-2024-48662.md): Cross Site Scripting vulnerability in AdGuard Application v.7.18.1 (4778) and before allows an attacker to execute arbitrary code via a craf (CVSS 6.1)
- [CVE-2024-54728](https://cve.now/CVE-2024-54728.md): Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0\_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs. (CVSS 6.5)
- [CVE-2024-55227](https://cve.now/CVE-2024-55227.md): A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web sc (CVSS 9.0, dolibarr/dolibarr)
- [CVE-2024-55228](https://cve.now/CVE-2024-55228.md): A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts (CVSS 9.0, dolibarr/dolibarr)
- [CVE-2024-56178](https://cve.now/CVE-2024-56178.md): An issue was discovered in Couchbase Server 7.6.x through 7.6.3. (CVSS 6.5)
- [CVE-2024-56316](https://cve.now/CVE-2024-56316.md): In AXESS ACS (Auto Configuration Server) through 5.2.0, unsanitized user input in the TR069 API allows remote unauthenticated attackers to c (CVSS 7.5)
- [CVE-2024-56947](https://cve.now/CVE-2024-56947.md): An issue in Xiamen Meitu Technology Co., Ltd. (CVSS 6.5)
- [CVE-2024-56948](https://cve.now/CVE-2024-56948.md): An issue in KuGou Technology CO. (CVSS 6.5)
- [CVE-2024-56949](https://cve.now/CVE-2024-56949.md): An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user inform (CVSS 6.5)
- [CVE-2024-56950](https://cve.now/CVE-2024-56950.md): An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted (CVSS 6.5)
- [CVE-2024-56951](https://cve.now/CVE-2024-56951.md): An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying (CVSS 6.5)
- [CVE-2024-56952](https://cve.now/CVE-2024-56952.md): An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information (CVSS 6.5)
- [CVE-2024-56953](https://cve.now/CVE-2024-56953.md): An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a craft (CVSS 6.5)
- [CVE-2024-56954](https://cve.now/CVE-2024-56954.md): An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information v (CVSS 6.5)
- [CVE-2024-56955](https://cve.now/CVE-2024-56955.md): An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplyi (CVSS 6.5)
- [CVE-2024-56957](https://cve.now/CVE-2024-56957.md): An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via su (CVSS 6.5)
- [CVE-2024-56959](https://cve.now/CVE-2024-56959.md): An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafte (CVSS 6.5)
- [CVE-2024-56960](https://cve.now/CVE-2024-56960.md): An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information v (CVSS 6.5)
- [CVE-2024-56962](https://cve.now/CVE-2024-56962.md): An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a (CVSS 6.5)
- [CVE-2024-56963](https://cve.now/CVE-2024-56963.md): An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via s (CVSS 6.5)
- [CVE-2024-56964](https://cve.now/CVE-2024-56964.md): An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user infor (CVSS 6.5)
- [CVE-2024-56965](https://cve.now/CVE-2024-56965.md): An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supp (CVSS 6.5)
- [CVE-2024-56966](https://cve.now/CVE-2024-56966.md): An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitiv (CVSS 6.5)
- [CVE-2024-56967](https://cve.now/CVE-2024-56967.md): An issue in Cloud Whale Interactive Technology LLC. (CVSS 6.5)
- [CVE-2024-56968](https://cve.now/CVE-2024-56968.md): An issue in Shenzhen Intellirocks Tech Co. (CVSS 6.5)
- [CVE-2024-56969](https://cve.now/CVE-2024-56969.md): An issue in Pixocial Technology (Singapore) Pte. (CVSS 6.5)
- [CVE-2024-56971](https://cve.now/CVE-2024-56971.md): An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive (CVSS 6.5)
- [CVE-2024-56972](https://cve.now/CVE-2024-56972.md): An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link. (CVSS 6.5)
- [CVE-2024-57052](https://cve.now/CVE-2024-57052.md): An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php file (CVSS 9.8)
- [CVE-2024-57272](https://cve.now/CVE-2024-57272.md): SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2024-57276](https://cve.now/CVE-2024-57276.md): In Electronic Arts Dragon Age Origins 1.05, the DAUpdaterSVC service contains an unquoted service path vulnerability. (CVSS 7.3)
- [CVE-2024-57373](https://cve.now/CVE-2024-57373.md): Cross Site Request Forgery (CSRF) vulnerability in LifestyleStore v1.0 allows a remote attacker to execute unauthorized actions on behalf of (CVSS 8.1)
- [CVE-2024-57546](https://cve.now/CVE-2024-57546.md): An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function. (CVSS 7.5)
- [CVE-2024-57547](https://cve.now/CVE-2024-57547.md): Insecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the F (CVSS 7.5)
- [CVE-2024-57548](https://cve.now/CVE-2024-57548.md): CMSimple 5.16 allows the user to edit log.php file via print page. (CVSS 9.1)
- [CVE-2024-57549](https://cve.now/CVE-2024-57549.md): CMSimple 5.16 allows the user to read cms source code through manipulation of the file name in the file parameter of a GET request. (CVSS 7.5)
- [CVE-2024-57590](https://cve.now/CVE-2024-57590.md): TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntp\_sync.cgi",which allows remote att (CVSS 9.8)
- [CVE-2024-57595](https://cve.now/CVE-2024-57595.md): DLINK DIR-825 REVB 2.03 devices have an OS command injection vulnerability in the CGl interface apc\_client\_pin.cgi, which allows remote atta (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.