# CVEs published 2025-01-30

152 CVEs were published on January 30, 2025: 6 critical, 52 high. Days are UTC.

- [CVE-2024-23963](https://cve.now/CVE-2024-23963.md): Alpine Halo9 Stack-based Buffer Overflow (CVSS 8.0, Alpine Halo9)
- [CVE-2024-23962](https://cve.now/CVE-2024-23962.md): Alpine Halo9 Missing Authentication (CVSS 5.3, Alpine Halo9)
- [CVE-2023-6195](https://cve.now/CVE-2023-6195.md): Server-Side Request Forgery (SSRF) in GitLab (CVSS 2.6, GitLab)
- [CVE-2024-1211](https://cve.now/CVE-2024-1211.md): Cross-Site Request Forgery (CSRF) in GitLab (CVSS 6.4, GitLab)
- [CVE-2024-23971](https://cve.now/CVE-2024-23971.md): ChargePoint Home Flex OCPP bswitch Command Injection (CVSS 8.8, ChargePoint Home Flex)
- [CVE-2024-23970](https://cve.now/CVE-2024-23970.md): ChargePoint Home Flex Improper Certificate Validation (CVSS 6.5, ChargePoint Home Flex)
- [CVE-2024-23969](https://cve.now/CVE-2024-23969.md): ChargePoint Home Flex wlanchnllst Out-Of-Bounds Write (CVSS 8.8, ChargePoint Home Flex)
- [CVE-2024-23968](https://cve.now/CVE-2024-23968.md): ChargePoint Home Flex SrvrToSmSetAutoChnlListMsg Stack-based Buffer Overflow (CVSS 8.8, ChargePoint Home Flex)
- [CVE-2024-23973](https://cve.now/CVE-2024-23973.md): Silicon Labs Gecko OS HTTP GET Request Handling Stack-based Buffer Overflow (CVSS 8.8, Silicon Labs Gecko OS)
- [CVE-2024-24731](https://cve.now/CVE-2024-24731.md): Silicon Labs Gecko OS http\_download Stack-based Buffer Overflow (CVSS 7.5, Silicon Labs Gecko OS)
- [CVE-2025-24885](https://cve.now/CVE-2025-24885.md): pwn.college has a XSS on dojo pages (CVSS 7.6, pwncollege dojo)
- [CVE-2025-24886](https://cve.now/CVE-2025-24886.md): pwn.college has Symlink LFI in Dojo repos (CVSS 7.7, pwncollege dojo)
- [CVE-2025-0882](https://cve.now/CVE-2025-0882.md): code-projects Chat System addnewmember.php sql injection (CVSS 5.3, code-projects Chat System)
- [CVE-2025-0881](https://cve.now/CVE-2025-0881.md): Codezips Gym Management System saveroutine.php sql injection (CVSS 5.3, Codezips Gym Management System)
- [CVE-2025-0880](https://cve.now/CVE-2025-0880.md): Codezips Gym Management System updateplan.php sql injection (CVSS 5.3, Codezips Gym Management System)
- [CVE-2024-11611](https://cve.now/CVE-2024-11611.md): AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, AutomationDirect C-More EA9)
- [CVE-2024-11610](https://cve.now/CVE-2024-11610.md): AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, AutomationDirect C-More EA9)
- [CVE-2024-11609](https://cve.now/CVE-2024-11609.md): AutomationDirect C-More EA9 EAP9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, AutomationDirect C-More EA9)
- [CVE-2025-0574](https://cve.now/CVE-2025-0574.md): Sante PACS Server URL path Memory Corruption Denial-of-Service Vulnerability (CVSS 8.2, Sante PACS Server)
- [CVE-2025-0572](https://cve.now/CVE-2025-0572.md): Sante PACS Server Web Portal DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability (CVSS 4.3, Sante PACS Server)
- [CVE-2025-0573](https://cve.now/CVE-2025-0573.md): Sante PACS Server DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability (CVSS 5.3, Sante PACS Server)
- [CVE-2025-0569](https://cve.now/CVE-2025-0569.md): Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability (CVSS 7.5, Sante PACS Server)
- [CVE-2025-0571](https://cve.now/CVE-2025-0571.md): Sante PACS Server Web Portal DCM File Parsing Memory Corruption Denial-of-Service Vulnerability (CVSS 6.5, Sante PACS Server)
- [CVE-2025-0570](https://cve.now/CVE-2025-0570.md): Sante PACS Server Web Portal DCM File Parsing Memory Corruption Denial-of-Service Vulnerability (CVSS 6.5, Sante PACS Server)
- [CVE-2025-0568](https://cve.now/CVE-2025-0568.md): Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability (CVSS 7.5, Sante PACS Server)
- [CVE-2025-0147](https://cve.now/CVE-2025-0147.md): Zoom Workplace App for Linux - Type Confusion (CVSS 8.8, Zoom Communications Zoom Workplace App for Linux)
- [CVE-2025-0146](https://cve.now/CVE-2025-0146.md): Zoom Workplace app for macOS - Symlink Following (CVSS 3.9, Zoom Communications Zoom Workplace app for macOS)
- [CVE-2025-0145](https://cve.now/CVE-2025-0145.md): Zoom Workplace Apps for Windows - Untrusted Search Path (CVSS 4.6, Zoom Communications Zoom Workplace Apps for Windows)
- [CVE-2025-0144](https://cve.now/CVE-2025-0144.md): Zoom Workplace Apps - Out-of-bounds Write (CVSS 3.1, Zoom Communications Zoom Workplace Apps)
- [CVE-2025-0143](https://cve.now/CVE-2025-0143.md): Zoom Workplace Apps for Linux - Out-of-bounds Write (CVSS 4.3, Zoom Communications Zoom Workplace Apps for Linux)
- [CVE-2025-0142](https://cve.now/CVE-2025-0142.md): Zoom Jenkins Marketplace plugin - Cleartext Storage of Sensitive Information (CVSS 4.3, Zoom Communications Zoom Jenkins Marketplace plugin · io.je…)
- [CVE-2025-24802](https://cve.now/CVE-2025-24802.md): Soundness issue with Plonky2 look up tables (CVSS 8.6, 0xPolygonZero plonky2 · plonky2)
- [CVE-2024-10604](https://cve.now/CVE-2024-10604.md): Identifiable Header Values In Fuchsia Leading To Tracking of The User (CVSS 6.9, Google Fuchsia)
- [CVE-2024-10603](https://cve.now/CVE-2024-10603.md): Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an exte (CVSS 6.3, Google gVisor)
- [CVE-2024-10026](https://cve.now/CVE-2024-10026.md): Improved Seeding and Hashing In gVisor (CVSS 6.3, Google gVisor)
- [CVE-2025-0681](https://cve.now/CVE-2025-0681.md): New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols (CVSS 6.9, New Rock Technologies OM500 IP-PBX · New Rock Technologi… +1)
- [CVE-2025-0680](https://cve.now/CVE-2025-0680.md): New Rock Technologies Cloud Connected Devices has a Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. (CVSS 9.3, New Rock Technologies OM500 IP-PBX · New Rock Technologi… +1)
- [CVE-2024-44142](https://cve.now/CVE-2024-44142.md): The issue was addressed with improved bounds checks. (CVSS 7.8, Apple GarageBand)
- [CVE-2025-24507](https://cve.now/CVE-2025-24507.md): This vulnerability allows appliance compromise at boot time. (CVSS 8.9, Broadcom Symantec Privileged Access Management)
- [CVE-2025-24506](https://cve.now/CVE-2025-24506.md): A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types. (CVSS 5.3, Broadcom Symantec Privileged Access Management)
- [CVE-2025-24505](https://cve.now/CVE-2025-24505.md): This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploadi (CVSS 8.8, Broadcom Symantec Privileged Access Management)
- [CVE-2025-24504](https://cve.now/CVE-2025-24504.md): An improper input validation the CSRF filter results in unsanitized user input written to the application logs. (CVSS 5.3, Broadcom Symantec Privileged Access Management)
- [CVE-2025-24503](https://cve.now/CVE-2025-24503.md): A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server. (CVSS 9.3, Broadcom Symantec Privileged Access Management)
- [CVE-2025-24502](https://cve.now/CVE-2025-24502.md): An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an (CVSS 5.3, Broadcom Symantec Privileged Access Management)
- [CVE-2025-24501](https://cve.now/CVE-2025-24501.md): An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request. (CVSS 5.3, Broadcom Symantec Privileged Access Management)
- [CVE-2025-0683](https://cve.now/CVE-2025-0683.md): Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Contec Health CMS8000 Patient Monitor (CVSS 8.2, Contec Health CMS8000 Patient Monitor)
- [CVE-2025-0626](https://cve.now/CVE-2025-0626.md): Hidden Functionality vulnerability in Contec Health CMS8000 Patient Monitor (CVSS 7.7, Contec Health CMS8000 Patient Monitor)
- [CVE-2024-12248](https://cve.now/CVE-2024-12248.md): Out-of-bounds Write vulnerability in Contec Health CMS8000 Patient Monitor (CVSS 9.3, Contec Health CMS8000 Patient Monitor)
- [CVE-2025-24500](https://cve.now/CVE-2025-24500.md): The vulnerability allows an unauthenticated attacker to access information in PAM database. (CVSS 8.7, Broadcom Symantec Privileged Access Management)
- [CVE-2025-0874](https://cve.now/CVE-2025-0874.md): code-projects Simple Plugins Car Rental Management approve.php sql injection (CVSS 5.3, code-projects Simple Plugins Car Rental Management)
- [CVE-2025-0477](https://cve.now/CVE-2025-0477.md): Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability (CVSS 9.3, Rockwell Automation FactoryTalk® AssetCentre)
- [CVE-2023-29080](https://cve.now/CVE-2023-29080.md): Privilege escalation in InstallShield (CVSS 8.5, Revenera InstallShield)
- [CVE-2025-0497](https://cve.now/CVE-2025-0497.md): Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability (CVSS 7.3, Rockwell Automation FactoryTalk® AssetCentre)
- [CVE-2025-0498](https://cve.now/CVE-2025-0498.md): Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability (CVSS 7.0, Rockwell Automation FactoryTalk® AssetCentre)
- [CVE-2024-2658](https://cve.now/CVE-2024-2658.md): Local privilege escalation in FlexNet Publisher (CVSS 8.5, Flexera FlexNet Publisher)
- [CVE-2025-0367](https://cve.now/CVE-2025-0367.md): Regular Expression Denial of Service (ReDoS) in Splunk Supporting Add-on for Active Directory (SA-ldapsearch) (CVSS 6.5, Splunk Supporting Add-on for Active Directory)
- [CVE-2025-0873](https://cve.now/CVE-2025-0873.md): itsourcecode Tailoring Management System customeredit.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2025-24099](https://cve.now/CVE-2025-24099.md): The issue was addressed with improved checks. (CVSS 5.1, Apple macOS)
- [CVE-2025-0872](https://cve.now/CVE-2025-0872.md): itsourcecode Tailoring Management System addpayment.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2025-24883](https://cve.now/CVE-2025-24883.md): go-ethereum has a DoS via malicious p2p message (CVSS 8.7, go-ethereum · github.com/ethereum/go-ethereum)
- [CVE-2025-24376](https://cve.now/CVE-2025-24376.md): The kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources (CVSS 6.5, kubewarden-controller · github.com/kubewarden/kubewarden-co…)
- [CVE-2025-24784](https://cve.now/CVE-2025-24784.md): kubewarden-controller has an Information leak via AdmissionPolicyGroup Resource (CVSS 4.3, kubewarden-controller · github.com/kubewarden/kubewarden-co…)
- [CVE-2025-22222](https://cve.now/CVE-2025-22222.md): VMware Aria Operations information disclosure vulnerability (CVE-2025-22222) (CVSS 7.7, VMware Aria Operations)
- [CVE-2025-22221](https://cve.now/CVE-2025-22221.md): VMware Aria Operations for Logs stored cross-site scripting vulnerability (CVE-2025-22221) (CVSS 5.2, VMware Aria Operations for Logs)
- [CVE-2025-23216](https://cve.now/CVE-2025-23216.md): Argo CD does not scrub secret values from patch errors (CVSS 6.8, argoproj argo-cd · github.com/argoproj/argo-cd/v2 +1)
- [CVE-2025-22220](https://cve.now/CVE-2025-22220.md): VMware Aria Operations for Logs broken access control vulnerability (CVE-2025-22220) (CVSS 4.3, VMware Aria Operations for Logs)
- [CVE-2025-22219](https://cve.now/CVE-2025-22219.md): VMware Aria Operations for Logs stored cross-site scripting vulnerability (CVE-2025-22219) (CVSS 6.8, VMware Aria Operations for Logs)
- [CVE-2025-0871](https://cve.now/CVE-2025-0871.md): Maybecms Add Article index.php cross site scripting (CVSS 5.3, Maybecms)
- [CVE-2025-23367](https://cve.now/CVE-2025-23367.md): Org.wildfly.core:wildfly-server: wildfly improper rbac permission (CVSS 6.5, wildfly-core · Red Hat JBoss Enterprise Application Plat… +7)
- [CVE-2025-22218](https://cve.now/CVE-2025-22218.md): VMware Aria Operations for Logs information disclosure vulnerability (CVSS 8.5, VMware Aria Operations for Logs)
- [CVE-2024-13349](https://cve.now/CVE-2024-13349.md): Stockdio Historical Chart \<= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Stockdio Historical Chart)
- [CVE-2024-13400](https://cve.now/CVE-2024-13400.md): Kona Gallery Block \<= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, gubbigubbi Kona Gallery Block)
- [CVE-2024-12102](https://cve.now/CVE-2024-12102.md): Typer Core \<= 1.9.6 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, seventhqueen Typer Core)
- [CVE-2024-10591](https://cve.now/CVE-2024-10591.md): MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics \<= 1.5.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update (CVSS 8.8, makewebbetter MWB HubSpot for WooCommerce – CRM, Abandoned…)
- [CVE-2024-10847](https://cve.now/CVE-2024-10847.md): Storely \<= 18 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, sellerthemes Storely)
- [CVE-2024-13664](https://cve.now/CVE-2024-13664.md): WP Post List Table \<= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpbean WP Post List Table)
- [CVE-2024-12129](https://cve.now/CVE-2024-12129.md): Royal Core \<= 2.9.2 - Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, Royal-Flush Royal Core)
- [CVE-2024-12822](https://cve.now/CVE-2024-12822.md): Media Manager for UserPro \<= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update (CVSS 9.8, DeluxeThemes Media Manager for UserPro)
- [CVE-2024-13596](https://cve.now/CVE-2024-13596.md): WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress \<= 1.7.5 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, pantherius WordPress Survey & Poll – Quiz, Survey and Poll…)
- [CVE-2024-12299](https://cve.now/CVE-2024-12299.md): System Dashboard \<= 2.8.17 - Reflected Cross-Site Scripting via Filename Parameter (CVSS 6.1, qriouslad System Dashboard)
- [CVE-2024-12451](https://cve.now/CVE-2024-12451.md): HTML5 chat \<= 1.07 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, proxymis HTML5 Chat)
- [CVE-2024-13715](https://cve.now/CVE-2024-13715.md): zStore Manager Basic \<= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache Clearing (CVSS 4.3, ilenejohnson zStore Manager Basic)
- [CVE-2024-8494](https://cve.now/CVE-2024-8494.md): Elementor Website Builder Pro – More than Just a Page Builder \<= 3.25.10 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode (CVSS 4.3, https://elementor.com/ Elementor Website Builder Pro)
- [CVE-2024-12177](https://cve.now/CVE-2024-12177.md): Ai Image Alt Text Generator for WP \<= 1.0.6 - Reflected Cross-Site Scripting (CVSS 6.1, wpmessiah Ai Image Alt Text Generator for WP)
- [CVE-2024-13670](https://cve.now/CVE-2024-13670.md): Music Sheet Viewer \<= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, efreja Music Sheet Viewer)
- [CVE-2024-12861](https://cve.now/CVE-2024-12861.md): W2S – Migrate WooCommerce to Shopify \<= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read (CVSS 6.5, villatheme W2S – Migrate WooCommerce to Shopify)
- [CVE-2024-13646](https://cve.now/CVE-2024-13646.md): Single-user-chat \<= 0.5 - Authenticated (Subscriber+) Limited Options Update (CVSS 8.1, aakashbhagat23 Single-user-chat)
- [CVE-2024-12821](https://cve.now/CVE-2024-12821.md): Media Manager for UserPro \<= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, DeluxeThemes Media Manager for UserPro)
- [CVE-2024-12320](https://cve.now/CVE-2024-12320.md): Team Rosters \<= 4.7 - Reflected Cross-Site Scripting via 'tab' (CVSS 6.1, markodonnell Team Rosters)
- [CVE-2024-13549](https://cve.now/CVE-2024-13549.md): All Bootstrap Blocks \<= 1.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, areoimiles All Bootstrap Blocks)
- [CVE-2024-13460](https://cve.now/CVE-2024-13460.md): WE – Testimonial Slider \<= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wordpresteem WE – Testimonial Slider)
- [CVE-2024-13742](https://cve.now/CVE-2024-13742.md): iControlWP – Multiple WordPress Site Manager \<= 4.4.5 - Unauthenticated PHP Object Injection (CVSS 9.8, paultgoodchild iControlWP)
- [CVE-2024-13707](https://cve.now/CVE-2024-13707.md): WP Image Uploader \<= 1.0.1 - Cross-Site Request Forgery to Arbitrary File Deletion (CVSS 8.8, filipmedia WP Image Uploader)
- [CVE-2024-11600](https://cve.now/CVE-2024-11600.md): Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg \<= 1.6.0 - Authenticated (Administrator+) Remote Code Execution (CVSS 7.2, visualmodo Borderless – Addons and Templates for Elementor)
- [CVE-2024-13652](https://cve.now/CVE-2024-13652.md): ECPay Ecommerce for WooCommerce \<= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion (CVSS 4.3, ecpaytechsupport ECPay Ecommerce for WooCommerce)
- [CVE-2024-13671](https://cve.now/CVE-2024-13671.md): Music Sheet Viewer \<= 4.1 - Unauthenticated Arbitrary File Read (CVSS 7.5, efreja Music Sheet Viewer)
- [CVE-2024-12269](https://cve.now/CVE-2024-12269.md): Safe Ai Malware Protection for WP \<= 1.0.17 - Missing Authorization to Unauthenticated Database Export (CVSS 7.5, wpmessiah Safe Ai Malware Protection for WP)
- [CVE-2024-13705](https://cve.now/CVE-2024-13705.md): StageShow \<= 9.8.6 - Reflected Cross-Site Scripting (CVSS 6.1, malcolm-oph StageShow)
- [CVE-2024-13720](https://cve.now/CVE-2024-13720.md): WP Image Uploader \<= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.8, filipmedia WP Image Uploader)
- [CVE-2024-13512](https://cve.now/CVE-2024-13512.md): Wonder FontAwesome \<= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, edigermatthew Wonder FontAwesome)
- [CVE-2024-13661](https://cve.now/CVE-2024-13661.md): Table Editor \<= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wptableeditor Table Editor)
- [CVE-2024-13700](https://cve.now/CVE-2024-13700.md): Embed Swagger UI \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, spanrig Embed Swagger UI)
- [CVE-2024-12444](https://cve.now/CVE-2024-12444.md): WP Dispensary \<= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, deviodigital WP Dispensary)
- [CVE-2024-11583](https://cve.now/CVE-2024-11583.md): Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg \<= 1.5.9 - Missing Authorization to Icon Font Deletion (CVSS 4.3, visualmodo Borderless – Addons and Templates for Elementor)
- [CVE-2025-0870](https://cve.now/CVE-2025-0870.md): Axiomatic Bento4 Ap4DataBuffer.h GetData heap-based overflow (CVSS 6.3, Axiomatic Bento4)
- [CVE-2025-0869](https://cve.now/CVE-2025-0869.md): Cianet ONU GW24AC Login cross site scripting (CVSS 5.3, Cianet ONU GW24AC)
- [CVE-2024-13466](https://cve.now/CVE-2024-13466.md): Automatically Hierarchic Categories in Menu \<= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, atakanau Automatically Hierarchic Categories in Menu)
- [CVE-2024-13380](https://cve.now/CVE-2024-13380.md): Alex Reservations: Smart Restaurant Booking \<= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, alexreservations Alex Reservations: Smart Restaurant Booking)
- [CVE-2022-43916](https://cve.now/CVE-2022-43916.md): IBM App Connect Enterprise Certified Container improper communications restriction (CVSS 6.8, IBM App Connect Enterprise Certified Container)
- [CVE-2025-0747](https://cve.now/CVE-2025-0747.md): Stored Cross-Site vulnerability in EmbedAI (CVSS 8.6, EmbedAI)
- [CVE-2025-0746](https://cve.now/CVE-2025-0746.md): Reflected Cross-Site Scripting vulnerability in EmbedAI (CVSS 6.1, EmbedAI)
- [CVE-2025-0745](https://cve.now/CVE-2025-0745.md): Improper Access Control vulnerability in EmbedAI (CVSS 7.5, EmbedAI)
- [CVE-2025-0744](https://cve.now/CVE-2025-0744.md): Improper Access Control vulnerability in EmbedAI (CVSS 7.5, EmbedAI)
- [CVE-2025-0743](https://cve.now/CVE-2025-0743.md): Improper Access Control vulnerability in EmbedAI (CVSS 5.3, EmbedAI)
- [CVE-2025-0742](https://cve.now/CVE-2025-0742.md): Improper Access Control vulnerability in EmbedAI (CVSS 5.8, EmbedAI)
- [CVE-2025-0741](https://cve.now/CVE-2025-0741.md): Improper Access Control vulnerability in EmbedAI (CVSS 5.8, EmbedAI)
- [CVE-2025-0740](https://cve.now/CVE-2025-0740.md): Improper Access Control vulnerability in EmbedAI (CVSS 8.6, EmbedAI)
- [CVE-2025-0739](https://cve.now/CVE-2025-0739.md): Improper Access Control vulnerability in EmbedAI (CVSS 8.6, EmbedAI)
- [CVE-2024-13706](https://cve.now/CVE-2024-13706.md): WP Image Uploader \<= 1.0.1 - Reflected Cross-Site Scripting (CVSS 6.1, filipmedia WP Image Uploader)
- [CVE-2024-12409](https://cve.now/CVE-2024-12409.md): Simple:Press Forum \<= 6.10.11 - Reflected Cross-Site Scripting (CVSS 6.1, simplepress Simple:Press Forum)
- [CVE-2024-13453](https://cve.now/CVE-2024-13453.md): Contact Form & SMTP Plugin for WordPress by PirateForms \<= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, smub Contact Form & SMTP Plugin for WordPress by PirateForms)
- [CVE-2024-12524](https://cve.now/CVE-2024-12524.md): Clinked Client Portal \<= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Clinked Client Portal)
- [CVE-2025-23007](https://cve.now/CVE-2025-23007.md): A vulnerability in the NetExtender Windows client log export function allows unauthorized access to sensitive Windows system files, potentia (CVSS 5.5, SonicWall NetExtender)
- [CVE-2025-0860](https://cve.now/CVE-2025-0860.md): VR-Frases (collect & share quotes) \<= 3.0.1 - Reflected Cross-Site Scripting (CVSS 6.1, vruizg VR-Frases)
- [CVE-2025-0861](https://cve.now/CVE-2025-0861.md): VR-Frases (collect & share quotes) \<= 3.0.1 - Authenticated (Admin+) SQL Injection (CVSS 4.9, vruizg VR-Frases)
- [CVE-2025-21107](https://cve.now/CVE-2025-21107.md): Dell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions contain(s) an Unquoted Search Path or Element vulnerab (CVSS 7.8, Dell NetWorker)
- [CVE-2025-0834](https://cve.now/CVE-2025-0834.md): Wondershare Dr.Fone Privilege Scalation Vulnerability (CVSS 7.8, Wondershare Dr.Fone)
- [CVE-2024-13694](https://cve.now/CVE-2024-13694.md): WooCommerce Wishlist \<= 1.8.7 - Unauthenticated Wishlist Disclosure via download\_pdf\_file Function (CVSS 7.5, MoreConvert Wishlist for WooCommerce)
- [CVE-2024-13758](https://cve.now/CVE-2024-13758.md): CP Contact Form with PayPal \<= 1.3.52 - Cross-Site Request Forgery (CVSS 6.5, codepeople CP Contact Form with PayPal)
- [CVE-2024-13732](https://cve.now/CVE-2024-13732.md): Responsive Blocks – WordPress Gutenberg Blocks \<= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via section\_tag Parameter (CVSS 6.4, cyberchimps Responsive Blocks – Page Builder for Blocks & P…)
- [CVE-2024-13470](https://cve.now/CVE-2024-13470.md): Ninja Forms – The Contact Form Builder That Grows With You \<= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2024-13642](https://cve.now/CVE-2024-13642.md): Stratum – Elementor Widgets \<= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot Widget (CVSS 6.4, jetmonsters Stratum Widgets for Elementor)
- [CVE-2024-13457](https://cve.now/CVE-2024-13457.md): Event Tickets \<= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure (CVSS 5.3, stellarwp Event Tickets and Registration)
- [CVE-2024-12709](https://cve.now/CVE-2024-12709.md): Bulk Me Now \<= 2.0 - Message Deletion via CSRF (CVSS 4.3, Bulk Me Now!)
- [CVE-2024-12708](https://cve.now/CVE-2024-12708.md): Bulk Me Now \<= 2.0 - Stored XSS via Shortcode (CVSS 7.1, Bulk Me Now!)
- [CVE-2024-12638](https://cve.now/CVE-2024-12638.md): Bulk Me Now \<= 2.0 - Reflected XSS (CVSS 7.1, Bulk Me Now!)
- [CVE-2024-12400](https://cve.now/CVE-2024-12400.md): Tourmaster \< 5.3.5 - Reflected XSS (CVSS 7.1, tourmaster)
- [CVE-2024-12163](https://cve.now/CVE-2024-12163.md): GoodLayers Core \< 2.1.3 - Subscriber+ Stored XSS via SVG Upload (CVSS 6.5, goodlayers-core)
- [CVE-2024-10309](https://cve.now/CVE-2024-10309.md): Tracking Code Manager \< 2.4.0 - Contributor+ Stored XSS (CVSS 5.9, Tracking Code Manager)
- [CVE-2024-12921](https://cve.now/CVE-2024-12921.md): EthereumICO \<= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ethereum-ico Shortcode (CVSS 6.4, ethereumicoio EthereumICO)
- [CVE-2025-0662](https://cve.now/CVE-2025-0662.md): Uninitialized kernel memory disclosure via ktrace(2) (CVSS 4.9, FreeBSD)
- [CVE-2025-0374](https://cve.now/CVE-2025-0374.md): Unprivileged access to system files (CVSS 6.5, FreeBSD)
- [CVE-2025-0373](https://cve.now/CVE-2025-0373.md): Buffer overflow in some filesystems via NFS (CVSS 6.0, FreeBSD)
- [CVE-2025-23374](https://cve.now/CVE-2025-23374.md): Dell Networking Switches running Enterprise SONiC OS, version(s) prior to 4.4.1 and 4.2.3, contain(s) an Insertion of Sensitive Information (CVSS 8.0, Dell Enterprise SONiC OS)
- [CVE-2025-0849](https://cve.now/CVE-2025-0849.md): CampCodes School Management Software Staff edit-staff improper authorization (CVSS 5.3, CampCodes School Management Software)
- [CVE-2025-0848](https://cve.now/CVE-2025-0848.md): Tenda A18 HTTP POST Request SetCmdlineRun stack-based overflow (CVSS 7.1, Tenda A18)
- [CVE-2025-0847](https://cve.now/CVE-2025-0847.md): 1000 Projects Employee Task Management System Login index.php sql injection (CVSS 6.9, 1000 Projects Employee Task Management System)
- [CVE-2025-0846](https://cve.now/CVE-2025-0846.md): 1000 Projects Employee Task Management System AdminLogin.php sql injection (CVSS 6.9, 1000 Projects Employee Task Management System)
- [CVE-2024-53615](https://cve.now/CVE-2024-53615.md): A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remot (CVSS 6.5, files.photo.gallery)
- [CVE-2024-55415](https://cve.now/CVE-2024-55415.md): DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass. (CVSS 5.7, tcg/voyager)
- [CVE-2024-55416](https://cve.now/CVE-2024-55416.md): DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. (CVSS 3.5, tcg/voyager)
- [CVE-2024-55417](https://cve.now/CVE-2024-55417.md): DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /a (CVSS 4.3, tcg/voyager)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.