CVEs published January 31, 2025
153 CVEs were published on January 31, 2025: 14 critical, 55 high.
- Published
- 153
- Critical
- 14
- High
- 55
- Medium
- 78
- Low
- 2
- Unrated
- 4
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- Linux
- 20
- IBM Sterling B2B Integrator
- 6
- Acronis Cyber Protect Cloud Agent
- 5
- Imagination Technologies Graphics DDK
- 5
- Pioneer DMH-WT7600NEX
- 3
- Canonical Apport
- 2
- ChargePoint Home Flex
- 2
- Contact Form and Calls To Action by vcita
- 2
- IBM Financial Transaction Manager for SWIFT Services for Mu…
- 2
- Lewe TeamCal Neo
- 2
Critical 14
- CVE-2025-24891Dumb Drop has an arbitrary file overwrite and path traversal for root shellDumbWareio DumbDrop
- CVE-2025-23215PMD Designer's release key passphrase (GPG) available on Maven Central in cleartextpmd · net.sourceforge.pmd:pmd-designer +2
- CVE-2025-0929SQL injection vulnerability in TeamCal NeoLewe TeamCal Neo
- CVE-2025-21673smb: client: fix double free of TCP_Server_Info::hostnameLinux
- CVE-2025-0493MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.14 - Unauthenticated Limited Local File Inclusionwcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…
- CVE-2022-1736Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.Canonical Ubuntu's gnome-control-center
- CVE-2024-47857SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures when using native SSH
- CVE-2024-53320Qualisys C++ SDK commit a32a21a was discovered to contain multiple stack buffer overflows via the GetCurrentFrame, SaveCapture, and LoadProj
- CVE-2024-53356Weak JWT Secret vulnerabilitiy in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote attackers to generate JWT for privilege esca
- CVE-2024-53537An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager.
- CVE-2024-53584OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter.
- CVE-2024-55062Code Injection vulnerability in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers to execute arbitrary
- CVE-2024-57587Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers to execute
- CVE-2025-22957A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without any authentication.
High 55
- CVE-2024-45650IBM Security Verify Directory denial of serviceIBM Security Verify Directory
- CVE-2025-21682eth: bnxt: always recalculate features after XDP clearing, fix null-derefLinux
- CVE-2025-21680pktgen: Avoid out-of-bounds access in get_imix_entriesLinux
- CVE-2025-21678gtp: Destroy device along with udp socket's netns dismantle.Linux
- CVE-2025-21677pfcp: Destroy device along with udp socket's netns dismantle.Linux
- CVE-2025-21676net: fec: handle page_pool_dev_alloc_pages errorLinux
- CVE-2025-21671zram: fix potential UAF of zram tableLinux
- CVE-2025-21669vsock/virtio: discard packets if the transport changesLinux
- CVE-2024-13472WooCommerce Product Table Lite <= 3.9.4 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scriptingwcproducttable Product Table and List Builder for WooCommer…
- CVE-2025-24749WordPress EZPZ SAML SP Single Sign On (SSO) plugin <= 1.2.5 - CSRF to Stored XSS vulnerabilityOvert Software Solutions EZPZ SAML SP Single Sign On
- CVE-2025-24718WordPress WP Sessions Time Monitoring Full Automatic Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityactivity-log.com WP Sessions Time Monitoring Full Automatic
- CVE-2025-24710WordPress Gwolle Guestbook plugin <= 4.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityMarcel Pol Gwolle Guestbook
- CVE-2025-24686WordPress RegistrationMagic Plugin <= 6.0.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMetagauss RegistrationMagic
- CVE-2025-24635WordPress Paytm – Donation Plugin plugin <= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityintegrationdevpaytm Paytm Payment Donation
- CVE-2025-24632WordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.9.0 -Reflected Cross Site Scripting (XSS) vulnerabilityalgol.plus Advanced Dynamic Pricing for WooCommerce
- CVE-2025-24609WordPress PORTONE 우커머스 결제 Plugin <= 3.2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityPORTONE 우커머스 결제
- CVE-2025-24608WordPress GD Mail Queue Plugin <= 4.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMilan Petrovic GD Mail Queue
- CVE-2025-24563WordPress Cleanup – Directory Listing & Classifieds plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilitythemeglow Cleanup – Directory Listing & Classifieds WordPre…
- CVE-2025-24560WordPress Awesome Event Booking plugin <= 2.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityAwesomeTOGI Awesome Event Booking
- CVE-2025-24551WordPress Radio Buttons and Swatches for WooCommerce plugin <= 1.1.20 - Reflected Cross Site Scripting (XSS) vulnerabilityoneteamsoftware Radio Buttons and Swatches for WooCommerce
- CVE-2025-24549WordPress Post Meta plugin <= 1.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityMahbubur Rahman Post Meta
- CVE-2025-24535WordPress SKT Donation plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerabilitysonalsinha21 SKT Donation
- CVE-2025-24534WordPress DPortfolio plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilitydinamiko DPortfolio
- CVE-2025-23759WordPress Affiliate Tools Việt Nam plugin <= 0.3.17 - Reflected Cross Site Scripting (XSS) vulnerabilityGavin Affiliate Tools Việt Nam
- CVE-2025-23671WordPress WP OpenSearch plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitysav WP OpenSearch
- CVE-2025-23596WordPress Notifikácie.sk plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitygrafeon Notifikácie.sk
- CVE-2025-23990WordPress Scroll Styler plugin <= 1.1 - CSRF to Stored XSS vulnerabilityjablonczay Scroll Styler
- CVE-2025-23989WordPress Internal Link Builder plugin <= 1.0 - CSRF to Stored XSS vulnerabilityAlessandro Piconi Internal Link Builder
- CVE-2025-23980WordPress Full Circle plugin <= 0.5.7.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityJames Andrews Full Circle
- CVE-2025-23978WordPress FlashCounter plugin <= 1.1.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityNinos FlashCounter
- CVE-2025-23977WordPress Post Carousel Slider plugin <= 2.0.1 - CSRF to Stored XSS vulnerabilityBhaskar Dhote Post Carousel Slider
- CVE-2025-23976WordPress Issuu Panel plugin <= 2.1.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityoperationsissuu Issuu Panel
- CVE-2025-22564WordPress Pretty Url Plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilityfaaiq Pretty Url
- CVE-2025-22341WordPress Hide Login+ plugin <= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityparswp Hide Login+
- CVE-2025-22332WordPress CloudFlare(R) Cache Purge plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityshanaver CloudFlare(R) Cache Purge
- CVE-2024-13504Shared Files – Frontend File Upload Form & Secure File Sharing <= 1.7.42 - Limited Unauthenticated Stored Cross-Site Scripting via File Uploadanssilaitila Shared Files – Frontend File Upload Form & Sec…
- CVE-2025-0809Link Fixer <= 3.4 - Unauthenticated Stored Cross-Site Scriptingkpgraham Link Fixer
- CVE-2024-47900GPU DDK - Multiple integer overflow in DmaTransfer PMR_DevPhysAddr functions leading to OOB writesImagination Technologies Graphics DDK
- CVE-2024-47899GPU DDK - PVRSRVDeviceServicesOpen use-after-free conditionImagination Technologies Graphics DDK
- CVE-2024-47898GPU DDK - PVRSRVDeviceSyncOpen use-after-free conditionImagination Technologies Graphics DDK
- CVE-2024-47891GPU DDK - Exploitable double free on PTL_STREAM_DESC object in the kernel function TLServerCloseStreamKM due to a race conditionImagination Technologies Graphics DDK
- CVE-2024-46974GPU DDK - Arbitrary write of read-only dmabufImagination Technologies Graphics DDK
- CVE-2024-13767Live2DWebCanvas <= 1.9.11 - Authenticated (Subscriber+) Arbitrary File Deletionjiangweifang Live2DWebCanvas
- CVE-2022-28653Users can consume unlimited disk space in /var/crashCanonical Apport
- CVE-2024-23921ChargePoint Home Flex Command InjectionChargePoint Home Flex
- CVE-2024-23920ChargePoint Home Flex Improper Access ControlChargePoint Home Flex
- CVE-2024-23929Pioneer DMH-WT7600NEX Telematics Directory TraversalPioneer DMH-WT7600NEX
- CVE-2024-52875An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5.GFI Kerio Control
- CVE-2024-53319A heap buffer overflow in the XML Text Escaping component of Qualisys C++ SDK commit a32a21a allows attackers to cause Denial of Service (Do
- CVE-2024-53355Multiple incorrect access control issues in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low
- CVE-2024-53357Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low pr
- CVE-2024-53582An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory trav
- CVE-2024-57432macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions.
- CVE-2024-57433macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function.
- CVE-2024-57434macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control.
Medium, low and unrated 84
- CVE-2025-0934code-projects Job Recruitment _call_job_search_ajax.php sql injectioncode-projects Job Recruitment
- CVE-2025-0938URL parser allowed square brackets in domain namesPython Software Foundation CPython
- CVE-2024-49349IBM Financial Transaction Manager cross-site scriptingIBM Financial Transaction Manager for SWIFT Services for Mu…
- CVE-2024-49339IBM Financial Transaction Manager cross-site scriptingIBM Financial Transaction Manager for SWIFT Services for Mu…
- CVE-2024-47116IBM Sterling B2B Integrator cross-site scriptingIBM Sterling B2B Integrator
- CVE-2024-45089IBM Sterling B2B Integrator information disclosureIBM Sterling B2B Integrator
- CVE-2024-49807IBM Sterling B2B Integrator cross-site scriptingIBM Sterling B2B Integrator
- CVE-2024-40696IBM Sterling B2B Integrator cross-site scriptingIBM Sterling B2B Integrator
- CVE-2024-47103IBM Sterling B2B Integrator cross-site scriptingIBM Sterling B2B Integrator
- CVE-2023-38739IBM Sterling B2B Integrator cross-site request forgeryIBM Sterling B2B Integrator
- CVE-2024-11741Grafana is an open-source platform for monitoring and observability.Grafana · github.com/grafana/grafana
- CVE-2025-0930Reflected Cross-Site Scripting (XSS) vulnerability in TeamCal NeoLewe TeamCal Neo
- CVE-2025-24828Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Protect Cloud Agent
- CVE-2025-24827Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Protect Cloud Agent
- CVE-2025-24829Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Protect Cloud Agent
- CVE-2025-24830Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Protect Cloud Agent
- CVE-2025-24831Local privilege escalation due to unquoted search path vulnerability.Acronis Cyber Protect Cloud Agent
- CVE-2025-21683bpf: Fix bpf_sk_select_reuseport() memory leakLinux
- CVE-2025-21681openvswitch: fix lockup on tx to unregistering netdev with carrierLinux
- CVE-2025-21679btrfs: add the missing error handling inside get_canonical_dev_pathLinux
- CVE-2025-21675net/mlx5: Clear port select structure when fail to createLinux
- CVE-2025-21674net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnelLinux
- CVE-2025-21672afs: Fix merge preference rule failure conditionLinux
- CVE-2025-21670vsock/bpf: return early if transport is not assignedLinux
- CVE-2025-21668pmdomain: imx8mp-blk-ctrl: add missing loop break conditionLinux
- CVE-2025-21667iomap: avoid avoid truncating 64-bit offset to 32 bitsLinux
- CVE-2025-21666vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]Linux
- CVE-2025-21665filemap: avoid truncating 64-bit offset to 32 bitsLinux
- CVE-2024-57948mac802154: check local interfaces before deleting sdata listLinux
- CVE-2024-12037Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemekraft Post Form – Registration Form – Profile Form for…
- CVE-2024-13662eHive Objects Image Grid <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingvernonsystems eHive Objects Image Grid
- CVE-2024-12415AI Infographic Maker <= 4.9.0 - Unauthenticated Arbitrary Shortcode Executionquantumcloud AI Infographic Maker
- CVE-2024-12267Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletionglenwpcoder Drag and Drop Multiple File Upload for Contact…
- CVE-2025-24597WordPress Barcode Generator for WooCommerce plugin <= 2.0.2 - Sensitive Data Exposure vulnerabilityDmitry V. (CEO of "UKR Solution") Barcode Generator for Woo…
- CVE-2025-23987WordPress Designer plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilitycodegearthemes Designer
- CVE-2025-23985WordPress Dynamic URL SEO plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerabilitybrainvireinfo Dynamic URL SEO
- CVE-2025-22757WordPress CodeBard Help Desk plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityCodeBard Help Desk
- CVE-2025-22720WordPress WpRently | WordPress plugin plugin <= 2.2.1 - Broken Access Control vulnerabilitymagepeopleteam Booking and Rental Manager
- CVE-2025-22265WordPress EMI Calculator plugin <= 1.1 - Settings Change vulnerabilitymgplugin EMI Calculator
- CVE-2024-44055WordPress Oshine Modules plugin < 3.3.6 - Unauthenticated Server Side Request Forgery (SSRF) vulnerabilitybrandexponents Oshine Modules
- CVE-2024-13566WP DataTable <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parametersamsk WP DataTable
- CVE-2024-13157MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS FeedMP3 Audio Player – Music Player, Podcast Player & Radio by…
- CVE-2024-13530Custom Login Page Styler <= 7.1.1 - Missing Authorization to Authenticated (Subsciber+) Log Deletion and Session Terminationzia-imtiaz Login Page Styler – Custom WordPress Login Page…
- CVE-2024-13623Order Export for WooCommerce <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directorywebfactory Order Export for WooCommerce
- CVE-2024-13226A5 Custom Login Page <= 2.8.1 - Reflected XSSA5 Custom Login Page
- CVE-2024-13225ECT Home Page Products <= 1.9 - Reflected XSSECT Home Page Products
- CVE-2024-13224SlideDeck 1 Lite Content Slider <= 1.4.8 - Reflected XSSSlideDeck 1 Lite Content Slider
- CVE-2024-13223Tabulate <= 2.10.3 - Reflected XSSTabulate
- CVE-2024-13222User Messages <= 1.2.4 - Reflected XSSUser Messages
- CVE-2024-13221Fantastic Elasticsearch <= 4.1.0 - Reflected XSSFantastic ElasticSearch
- CVE-2024-13220Google Map Professional <= 1.0 - Reflected XSSWordPress Google Map Professional
- CVE-2024-13219Policy Genius <= 2.0.4 - Reflected XSSPrivacy Policy Genius
- CVE-2024-13218Fast Tube <= 2.3.1 - Reflected XSSFast Tube
- CVE-2024-13112WP MediaTagger <= 4.1.1 - Reflected XSSWP MediaTagger
- CVE-2024-13101WP MediaTagger <= 4.1.1 - Contributor+ Stored XSSWP MediaTagger
- CVE-2024-13100Woo UPS Pickup <= 2.6.3 - Reflected XSSOPSI Israel Domestic Shipments
- CVE-2024-12872Zalomení <= 1.5 - Admin+ Stored XSSZalomení
- CVE-2024-12772Ninja Tables < 5.0.17 - Admin+ Stored XSSNinja Tables
- CVE-2024-12275CanvasFlow <= 1.5.5 - Reflected XSSCanvasflow for WordPress
- CVE-2025-22216CVE-2025-22216 UAA Missing Zone ValidationCloud Foundry UAA
- CVE-2024-13424Ni Sales Commission For WooCommerce <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Commission Updateanzia Ni Sales Commission For WooCommerce
- CVE-2024-13415Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 5.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Updatetechlabpro1 Food Menu – Restaurant Menu & Online Ordering f…
- CVE-2024-13717Contact Form and Calls To Action by vcita <= 2.7.1 - Missing Authorization to Authenticated (Subscriber+) Contact/Widget ToggleContact Form and Calls To Action by vcita
- CVE-2024-11886Contact Form and Calls To Action by vcita <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingContact Form and Calls To Action by vcita
- CVE-2024-13216HT Event – WordPress Event Manager Plugin for Elementor <= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: Sponsordevitemsllc HT Event – WordPress Event Manager Plugin for E…
- CVE-2024-10867Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploadvisualmodo Borderless – Addons and Templates for Elementor
- CVE-2025-0507Ticketmeo – Sell Tickets – Event Ticketing <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesnexed Ticketmeo – Sell Tickets – Event Ticketing
- CVE-2025-0470Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameterwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2024-13463SeatReg <= 1.56.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingthesiim SeatReg
- CVE-2024-13397WPRadio – WordPress Radio Streaming Plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingcasterfm WPRadio – WordPress Radio Streaming Plugin
- CVE-2024-13396Frictionless <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site Scriptingspgajjar Frictionless
- CVE-2024-13399Gosign – Posts Slider Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingGosign – Posts Slider Block
- CVE-2023-0092An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from thCanonical Juju · github.com/juju/juju
- CVE-2020-11936gdbus setgid privilege escalationCanonical Apport
- CVE-2024-23928Pioneer DMH-WT7600NEX Telematics Improper Certificate ValidationPioneer DMH-WT7600NEX
- CVE-2024-23937Silicon Labs Gecko OS Debug Interface Format StringSilicon Labs Gecko OS
- CVE-2025-24336SXF Common Library handles input data improperly.General Incorporated Association OCF SXF Common Library
- CVE-2024-23930Pioneer DMH-WT7600NEX Media Service Improper Handling of Exceptional ConditionsPioneer DMH-WT7600NEX
- CVE-2024-42671A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicio
- CVE-2024-53007Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an APIBentley ProjectWise Integration Server
- CVE-2024-53354Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers to execute a
- CVE-2024-57435In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a null pointer dereferenc
- CVE-2025-22994O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings.
- CVE-2025-23001A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header.