CVEs published January 30, 2025
152 CVEs were published on January 30, 2025: 6 critical, 52 high.
- Published
- 152
- Critical
- 6
- High
- 52
- Medium
- 90
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 39
Most affected products
- EmbedAI
- 9
- Broadcom Symantec Privileged Access Management
- 8
- Sante PACS Server
- 7
- ChargePoint Home Flex
- 4
- VMware Aria Operations for Logs
- 4
- AutomationDirect C-More EA9
- 3
- Bulk Me Now!
- 3
- Contec Health CMS8000 Patient Monitor
- 3
- filipmedia WP Image Uploader
- 3
- FreeBSD
- 3
Critical 6
- CVE-2025-0680New Rock Technologies Cloud Connected Devices has a Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.New Rock Technologies OM500 IP-PBX · New Rock Technologi… +1
- CVE-2025-24503A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.Broadcom Symantec Privileged Access Management
- CVE-2024-12248Out-of-bounds Write vulnerability in Contec Health CMS8000 Patient MonitorContec Health CMS8000 Patient Monitor
- CVE-2025-0477Rockwell Automation FactoryTalk® AssetCentre Data Exposure VulnerabilityRockwell Automation FactoryTalk® AssetCentre
- CVE-2024-12822Media Manager for UserPro <= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options UpdateDeluxeThemes Media Manager for UserPro
- CVE-2024-13742iControlWP – Multiple WordPress Site Manager <= 4.4.5 - Unauthenticated PHP Object Injectionpaultgoodchild iControlWP
High 52
- CVE-2024-23963Alpine Halo9 Stack-based Buffer OverflowAlpine Halo9
- CVE-2024-23971ChargePoint Home Flex OCPP bswitch Command InjectionChargePoint Home Flex
- CVE-2024-23969ChargePoint Home Flex wlanchnllst Out-Of-Bounds WriteChargePoint Home Flex
- CVE-2024-23968ChargePoint Home Flex SrvrToSmSetAutoChnlListMsg Stack-based Buffer OverflowChargePoint Home Flex
- CVE-2024-23973Silicon Labs Gecko OS HTTP GET Request Handling Stack-based Buffer OverflowSilicon Labs Gecko OS
- CVE-2024-24731Silicon Labs Gecko OS http_download Stack-based Buffer OverflowSilicon Labs Gecko OS
- CVE-2025-24885pwn.college has a XSS on dojo pagespwncollege dojo
- CVE-2025-24886pwn.college has Symlink LFI in Dojo repospwncollege dojo
- CVE-2024-11611AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution VulnerabilityAutomationDirect C-More EA9
- CVE-2024-11610AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution VulnerabilityAutomationDirect C-More EA9
- CVE-2024-11609AutomationDirect C-More EA9 EAP9 File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityAutomationDirect C-More EA9
- CVE-2025-0574Sante PACS Server URL path Memory Corruption Denial-of-Service VulnerabilitySante PACS Server
- CVE-2025-0569Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service VulnerabilitySante PACS Server
- CVE-2025-0568Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service VulnerabilitySante PACS Server
- CVE-2025-0147Zoom Workplace App for Linux - Type ConfusionZoom Communications Zoom Workplace App for Linux
- CVE-2025-24802Soundness issue with Plonky2 look up tables0xPolygonZero plonky2 · plonky2
- CVE-2024-44142The issue was addressed with improved bounds checks.Apple GarageBand
- CVE-2025-24507This vulnerability allows appliance compromise at boot time.Broadcom Symantec Privileged Access Management
- CVE-2025-24505This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploadiBroadcom Symantec Privileged Access Management
- CVE-2025-0683Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Contec Health CMS8000 Patient MonitorContec Health CMS8000 Patient Monitor
- CVE-2025-0626Hidden Functionality vulnerability in Contec Health CMS8000 Patient MonitorContec Health CMS8000 Patient Monitor
- CVE-2025-24500The vulnerability allows an unauthenticated attacker to access information in PAM database.Broadcom Symantec Privileged Access Management
- CVE-2023-29080Privilege escalation in InstallShieldRevenera InstallShield
- CVE-2025-0497Rockwell Automation FactoryTalk® AssetCentre Data Exposure VulnerabilityRockwell Automation FactoryTalk® AssetCentre
- CVE-2025-0498Rockwell Automation FactoryTalk® AssetCentre Data Exposure VulnerabilityRockwell Automation FactoryTalk® AssetCentre
- CVE-2024-2658Local privilege escalation in FlexNet PublisherFlexera FlexNet Publisher
- CVE-2025-24883go-ethereum has a DoS via malicious p2p messagego-ethereum · github.com/ethereum/go-ethereum
- CVE-2025-22222VMware Aria Operations information disclosure vulnerability (CVE-2025-22222)VMware Aria Operations
- CVE-2025-22218VMware Aria Operations for Logs information disclosure vulnerabilityVMware Aria Operations for Logs
- CVE-2024-10591MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.5.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Updatemakewebbetter MWB HubSpot for WooCommerce – CRM, Abandoned…
- CVE-2024-12129Royal Core <= 2.9.2 - Authenticated (Subscriber+) Arbitrary Options UpdateRoyal-Flush Royal Core
- CVE-2024-13646Single-user-chat <= 0.5 - Authenticated (Subscriber+) Limited Options Updateaakashbhagat23 Single-user-chat
- CVE-2024-12821Media Manager for UserPro <= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateDeluxeThemes Media Manager for UserPro
- CVE-2024-13707WP Image Uploader <= 1.0.1 - Cross-Site Request Forgery to Arbitrary File Deletionfilipmedia WP Image Uploader
- CVE-2024-11600Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.0 - Authenticated (Administrator+) Remote Code Executionvisualmodo Borderless – Addons and Templates for Elementor
- CVE-2024-13671Music Sheet Viewer <= 4.1 - Unauthenticated Arbitrary File Readefreja Music Sheet Viewer
- CVE-2024-12269Safe Ai Malware Protection for WP <= 1.0.17 - Missing Authorization to Unauthenticated Database Exportwpmessiah Safe Ai Malware Protection for WP
- CVE-2024-13720WP Image Uploader <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletionfilipmedia WP Image Uploader
- CVE-2025-0747Stored Cross-Site vulnerability in EmbedAIEmbedAI
- CVE-2025-0745Improper Access Control vulnerability in EmbedAIEmbedAI
- CVE-2025-0744Improper Access Control vulnerability in EmbedAIEmbedAI
- CVE-2025-0740Improper Access Control vulnerability in EmbedAIEmbedAI
- CVE-2025-0739Improper Access Control vulnerability in EmbedAIEmbedAI
- CVE-2024-13453Contact Form & SMTP Plugin for WordPress by PirateForms <= 2.6.0 - Unauthenticated Arbitrary Shortcode Executionsmub Contact Form & SMTP Plugin for WordPress by PirateForms
- CVE-2025-21107Dell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions contain(s) an Unquoted Search Path or Element vulnerabDell NetWorker
- CVE-2025-0834Wondershare Dr.Fone Privilege Scalation VulnerabilityWondershare Dr.Fone
- CVE-2024-13694WooCommerce Wishlist <= 1.8.7 - Unauthenticated Wishlist Disclosure via download_pdf_file FunctionMoreConvert Wishlist for WooCommerce
- CVE-2024-12708Bulk Me Now <= 2.0 - Stored XSS via ShortcodeBulk Me Now!
- CVE-2024-12638Bulk Me Now <= 2.0 - Reflected XSSBulk Me Now!
- CVE-2024-12400Tourmaster < 5.3.5 - Reflected XSStourmaster
- CVE-2025-23374Dell Networking Switches running Enterprise SONiC OS, version(s) prior to 4.4.1 and 4.2.3, contain(s) an Insertion of Sensitive Information Dell Enterprise SONiC OS
- CVE-2025-0848Tenda A18 HTTP POST Request SetCmdlineRun stack-based overflowTenda A18
Medium, low and unrated 94
- CVE-2024-23962Alpine Halo9 Missing AuthenticationAlpine Halo9
- CVE-2023-6195Server-Side Request Forgery (SSRF) in GitLabGitLab
- CVE-2024-1211Cross-Site Request Forgery (CSRF) in GitLabGitLab
- CVE-2024-23970ChargePoint Home Flex Improper Certificate ValidationChargePoint Home Flex
- CVE-2025-0882code-projects Chat System addnewmember.php sql injectioncode-projects Chat System
- CVE-2025-0881Codezips Gym Management System saveroutine.php sql injectionCodezips Gym Management System
- CVE-2025-0880Codezips Gym Management System updateplan.php sql injectionCodezips Gym Management System
- CVE-2025-0572Sante PACS Server Web Portal DCM File Parsing Directory Traversal Arbitrary File Write VulnerabilitySante PACS Server
- CVE-2025-0573Sante PACS Server DCM File Parsing Directory Traversal Arbitrary File Write VulnerabilitySante PACS Server
- CVE-2025-0571Sante PACS Server Web Portal DCM File Parsing Memory Corruption Denial-of-Service VulnerabilitySante PACS Server
- CVE-2025-0570Sante PACS Server Web Portal DCM File Parsing Memory Corruption Denial-of-Service VulnerabilitySante PACS Server
- CVE-2025-0146Zoom Workplace app for macOS - Symlink FollowingZoom Communications Zoom Workplace app for macOS
- CVE-2025-0145Zoom Workplace Apps for Windows - Untrusted Search PathZoom Communications Zoom Workplace Apps for Windows
- CVE-2025-0144Zoom Workplace Apps - Out-of-bounds WriteZoom Communications Zoom Workplace Apps
- CVE-2025-0143Zoom Workplace Apps for Linux - Out-of-bounds WriteZoom Communications Zoom Workplace Apps for Linux
- CVE-2025-0142Zoom Jenkins Marketplace plugin - Cleartext Storage of Sensitive InformationZoom Communications Zoom Jenkins Marketplace plugin · io.je…
- CVE-2024-10604Identifiable Header Values In Fuchsia Leading To Tracking of The UserGoogle Fuchsia
- CVE-2024-10603Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an exteGoogle gVisor
- CVE-2024-10026Improved Seeding and Hashing In gVisorGoogle gVisor
- CVE-2025-0681New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching SymbolsNew Rock Technologies OM500 IP-PBX · New Rock Technologi… +1
- CVE-2025-24506A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types.Broadcom Symantec Privileged Access Management
- CVE-2025-24504An improper input validation the CSRF filter results in unsanitized user input written to the application logs.Broadcom Symantec Privileged Access Management
- CVE-2025-24502An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of anBroadcom Symantec Privileged Access Management
- CVE-2025-24501An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request.Broadcom Symantec Privileged Access Management
- CVE-2025-0874code-projects Simple Plugins Car Rental Management approve.php sql injectioncode-projects Simple Plugins Car Rental Management
- CVE-2025-0367Regular Expression Denial of Service (ReDoS) in Splunk Supporting Add-on for Active Directory (SA-ldapsearch)Splunk Supporting Add-on for Active Directory
- CVE-2025-0873itsourcecode Tailoring Management System customeredit.php sql injectionitsourcecode Tailoring Management System
- CVE-2025-24099The issue was addressed with improved checks.Apple macOS
- CVE-2025-0872itsourcecode Tailoring Management System addpayment.php sql injectionitsourcecode Tailoring Management System
- CVE-2025-24376The kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resourceskubewarden-controller · github.com/kubewarden/kubewarden-co…
- CVE-2025-24784kubewarden-controller has an Information leak via AdmissionPolicyGroup Resourcekubewarden-controller · github.com/kubewarden/kubewarden-co…
- CVE-2025-22221VMware Aria Operations for Logs stored cross-site scripting vulnerability (CVE-2025-22221)VMware Aria Operations for Logs
- CVE-2025-23216Argo CD does not scrub secret values from patch errorsargoproj argo-cd · github.com/argoproj/argo-cd/v2 +1
- CVE-2025-22220VMware Aria Operations for Logs broken access control vulnerability (CVE-2025-22220)VMware Aria Operations for Logs
- CVE-2025-22219VMware Aria Operations for Logs stored cross-site scripting vulnerability (CVE-2025-22219)VMware Aria Operations for Logs
- CVE-2025-0871Maybecms Add Article index.php cross site scriptingMaybecms
- CVE-2025-23367Org.wildfly.core:wildfly-server: wildfly improper rbac permissionwildfly-core · Red Hat JBoss Enterprise Application Plat… +7
- CVE-2024-13349Stockdio Historical Chart <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site ScriptingStockdio Historical Chart
- CVE-2024-13400Kona Gallery Block <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scriptinggubbigubbi Kona Gallery Block
- CVE-2024-12102Typer Core <= 1.9.6 - Authenticated (Contributor+) Post Disclosureseventhqueen Typer Core
- CVE-2024-10847Storely <= 18 - Authenticated (Contributor+) Stored Cross-Site Scriptingsellerthemes Storely
- CVE-2024-13664WP Post List Table <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpbean WP Post List Table
- CVE-2024-13596WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) SQL Injectionpantherius WordPress Survey & Poll – Quiz, Survey and Poll…
- CVE-2024-12299System Dashboard <= 2.8.17 - Reflected Cross-Site Scripting via Filename Parameterqriouslad System Dashboard
- CVE-2024-12451HTML5 chat <= 1.07 - Authenticated (Contributor+) Stored Cross-Site Scriptingproxymis HTML5 Chat
- CVE-2024-13715zStore Manager Basic <= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache Clearingilenejohnson zStore Manager Basic
- CVE-2024-8494Elementor Website Builder Pro – More than Just a Page Builder <= 3.25.10 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcodehttps://elementor.com/ Elementor Website Builder Pro
- CVE-2024-12177Ai Image Alt Text Generator for WP <= 1.0.6 - Reflected Cross-Site Scriptingwpmessiah Ai Image Alt Text Generator for WP
- CVE-2024-13670Music Sheet Viewer <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingefreja Music Sheet Viewer
- CVE-2024-12861W2S – Migrate WooCommerce to Shopify <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Readvillatheme W2S – Migrate WooCommerce to Shopify
- CVE-2024-12320Team Rosters <= 4.7 - Reflected Cross-Site Scripting via 'tab'markodonnell Team Rosters
- CVE-2024-13549All Bootstrap Blocks <= 1.3.26 - Authenticated (Contributor+) Stored Cross-Site Scriptingareoimiles All Bootstrap Blocks
- CVE-2024-13460WE – Testimonial Slider <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingwordpresteem WE – Testimonial Slider
- CVE-2024-13652ECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletionecpaytechsupport ECPay Ecommerce for WooCommerce
- CVE-2024-13705StageShow <= 9.8.6 - Reflected Cross-Site Scriptingmalcolm-oph StageShow
- CVE-2024-13512Wonder FontAwesome <= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scriptingedigermatthew Wonder FontAwesome
- CVE-2024-13661Table Editor <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingwptableeditor Table Editor
- CVE-2024-13700Embed Swagger UI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingspanrig Embed Swagger UI
- CVE-2024-12444WP Dispensary <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingdeviodigital WP Dispensary
- CVE-2024-11583Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.9 - Missing Authorization to Icon Font Deletionvisualmodo Borderless – Addons and Templates for Elementor
- CVE-2025-0870Axiomatic Bento4 Ap4DataBuffer.h GetData heap-based overflowAxiomatic Bento4
- CVE-2025-0869Cianet ONU GW24AC Login cross site scriptingCianet ONU GW24AC
- CVE-2024-13466Automatically Hierarchic Categories in Menu <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingatakanau Automatically Hierarchic Categories in Menu
- CVE-2024-13380Alex Reservations: Smart Restaurant Booking <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodealexreservations Alex Reservations: Smart Restaurant Booking
- CVE-2022-43916IBM App Connect Enterprise Certified Container improper communications restrictionIBM App Connect Enterprise Certified Container
- CVE-2025-0746Reflected Cross-Site Scripting vulnerability in EmbedAIEmbedAI
- CVE-2025-0743Improper Access Control vulnerability in EmbedAIEmbedAI
- CVE-2025-0742Improper Access Control vulnerability in EmbedAIEmbedAI
- CVE-2025-0741Improper Access Control vulnerability in EmbedAIEmbedAI
- CVE-2024-13706WP Image Uploader <= 1.0.1 - Reflected Cross-Site Scriptingfilipmedia WP Image Uploader
- CVE-2024-12409Simple:Press Forum <= 6.10.11 - Reflected Cross-Site Scriptingsimplepress Simple:Press Forum
- CVE-2024-12524Clinked Client Portal <= 1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingClinked Client Portal
- CVE-2025-23007A vulnerability in the NetExtender Windows client log export function allows unauthorized access to sensitive Windows system files, potentiaSonicWall NetExtender
- CVE-2025-0860VR-Frases (collect & share quotes) <= 3.0.1 - Reflected Cross-Site Scriptingvruizg VR-Frases
- CVE-2025-0861VR-Frases (collect & share quotes) <= 3.0.1 - Authenticated (Admin+) SQL Injectionvruizg VR-Frases
- CVE-2024-13758CP Contact Form with PayPal <= 1.3.52 - Cross-Site Request Forgerycodepeople CP Contact Form with PayPal
- CVE-2024-13732Responsive Blocks – WordPress Gutenberg Blocks <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via section_tag Parametercyberchimps Responsive Blocks – Page Builder for Blocks & P…
- CVE-2024-13470Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodekstover Ninja Forms – The Contact Form Builder That Grows W…
- CVE-2024-13642Stratum – Elementor Widgets <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot Widgetjetmonsters Stratum Widgets for Elementor
- CVE-2024-13457Event Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposurestellarwp Event Tickets and Registration
- CVE-2024-12709Bulk Me Now <= 2.0 - Message Deletion via CSRFBulk Me Now!
- CVE-2024-12163GoodLayers Core < 2.1.3 - Subscriber+ Stored XSS via SVG Uploadgoodlayers-core
- CVE-2024-10309Tracking Code Manager < 2.4.0 - Contributor+ Stored XSSTracking Code Manager
- CVE-2024-12921EthereumICO <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ethereum-ico Shortcodeethereumicoio EthereumICO
- CVE-2025-0662Uninitialized kernel memory disclosure via ktrace(2)FreeBSD
- CVE-2025-0374Unprivileged access to system filesFreeBSD
- CVE-2025-0373Buffer overflow in some filesystems via NFSFreeBSD
- CVE-2025-0849CampCodes School Management Software Staff edit-staff improper authorizationCampCodes School Management Software
- CVE-2025-08471000 Projects Employee Task Management System Login index.php sql injection1000 Projects Employee Task Management System
- CVE-2025-08461000 Projects Employee Task Management System AdminLogin.php sql injection1000 Projects Employee Task Management System
- CVE-2024-53615A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remotfiles.photo.gallery
- CVE-2024-55415DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass.tcg/voyager
- CVE-2024-55416DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass.tcg/voyager
- CVE-2024-55417DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /atcg/voyager