# CVEs published 2025-01-31

153 CVEs were published on January 31, 2025: 14 critical, 55 high. Days are UTC.

- [CVE-2025-24891](https://cve.now/CVE-2025-24891.md): Dumb Drop has an arbitrary file overwrite and path traversal for root shell (CVSS 9.7, DumbWareio DumbDrop)
- [CVE-2025-0934](https://cve.now/CVE-2025-0934.md): code-projects Job Recruitment \_call\_job\_search\_ajax.php sql injection (CVSS 5.3, code-projects Job Recruitment)
- [CVE-2025-0938](https://cve.now/CVE-2025-0938.md): URL parser allowed square brackets in domain names (CVSS 6.3, Python Software Foundation CPython)
- [CVE-2024-49349](https://cve.now/CVE-2024-49349.md): IBM Financial Transaction Manager cross-site scripting (CVSS 6.1, IBM Financial Transaction Manager for SWIFT Services for Mu…)
- [CVE-2024-49339](https://cve.now/CVE-2024-49339.md): IBM Financial Transaction Manager cross-site scripting (CVSS 6.4, IBM Financial Transaction Manager for SWIFT Services for Mu…)
- [CVE-2024-47116](https://cve.now/CVE-2024-47116.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2024-45089](https://cve.now/CVE-2024-45089.md): IBM Sterling B2B Integrator information disclosure (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2025-23215](https://cve.now/CVE-2025-23215.md): PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext (CVSS 9.3, pmd · net.sourceforge.pmd:pmd-designer +2)
- [CVE-2024-49807](https://cve.now/CVE-2024-49807.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 6.4, IBM Sterling B2B Integrator)
- [CVE-2024-40696](https://cve.now/CVE-2024-40696.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 4.8, IBM Sterling B2B Integrator)
- [CVE-2024-47103](https://cve.now/CVE-2024-47103.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 4.8, IBM Sterling B2B Integrator)
- [CVE-2023-38739](https://cve.now/CVE-2023-38739.md): IBM Sterling B2B Integrator cross-site request forgery (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2024-11741](https://cve.now/CVE-2024-11741.md): Grafana is an open-source platform for monitoring and observability. (CVSS 4.3, Grafana · github.com/grafana/grafana)
- [CVE-2024-45650](https://cve.now/CVE-2024-45650.md): IBM Security Verify Directory denial of service (CVSS 7.5, IBM Security Verify Directory)
- [CVE-2025-0930](https://cve.now/CVE-2025-0930.md): Reflected Cross-Site Scripting (XSS) vulnerability in TeamCal Neo (CVSS 6.1, Lewe TeamCal Neo)
- [CVE-2025-0929](https://cve.now/CVE-2025-0929.md): SQL injection vulnerability in TeamCal Neo (CVSS 9.8, Lewe TeamCal Neo)
- [CVE-2025-24828](https://cve.now/CVE-2025-24828.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.3, Acronis Cyber Protect Cloud Agent)
- [CVE-2025-24827](https://cve.now/CVE-2025-24827.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.3, Acronis Cyber Protect Cloud Agent)
- [CVE-2025-24829](https://cve.now/CVE-2025-24829.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.3, Acronis Cyber Protect Cloud Agent)
- [CVE-2025-24830](https://cve.now/CVE-2025-24830.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.3, Acronis Cyber Protect Cloud Agent)
- [CVE-2025-24831](https://cve.now/CVE-2025-24831.md): Local privilege escalation due to unquoted search path vulnerability. (CVSS 6.6, Acronis Cyber Protect Cloud Agent)
- [CVE-2025-21683](https://cve.now/CVE-2025-21683.md): bpf: Fix bpf\_sk\_select\_reuseport() memory leak (CVSS 5.5, Linux)
- [CVE-2025-21682](https://cve.now/CVE-2025-21682.md): eth: bnxt: always recalculate features after XDP clearing, fix null-deref (CVSS 7.3, Linux)
- [CVE-2025-21681](https://cve.now/CVE-2025-21681.md): openvswitch: fix lockup on tx to unregistering netdev with carrier (no CVSS, Linux)
- [CVE-2025-21680](https://cve.now/CVE-2025-21680.md): pktgen: Avoid out-of-bounds access in get\_imix\_entries (CVSS 7.8, Linux)
- [CVE-2025-21679](https://cve.now/CVE-2025-21679.md): btrfs: add the missing error handling inside get\_canonical\_dev\_path (no CVSS, Linux)
- [CVE-2025-21678](https://cve.now/CVE-2025-21678.md): gtp: Destroy device along with udp socket's netns dismantle. (CVSS 7.8, Linux)
- [CVE-2025-21677](https://cve.now/CVE-2025-21677.md): pfcp: Destroy device along with udp socket's netns dismantle. (CVSS 7.8, Linux)
- [CVE-2025-21676](https://cve.now/CVE-2025-21676.md): net: fec: handle page\_pool\_dev\_alloc\_pages error (CVSS 7.5, Linux)
- [CVE-2025-21675](https://cve.now/CVE-2025-21675.md): net/mlx5: Clear port select structure when fail to create (CVSS 5.5, Linux)
- [CVE-2025-21674](https://cve.now/CVE-2025-21674.md): net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel (CVSS 5.5, Linux)
- [CVE-2025-21673](https://cve.now/CVE-2025-21673.md): smb: client: fix double free of TCP\_Server\_Info::hostname (CVSS 9.8, Linux)
- [CVE-2025-21672](https://cve.now/CVE-2025-21672.md): afs: Fix merge preference rule failure condition (CVSS 5.5, Linux)
- [CVE-2025-21671](https://cve.now/CVE-2025-21671.md): zram: fix potential UAF of zram table (CVSS 7.8, Linux)
- [CVE-2025-21670](https://cve.now/CVE-2025-21670.md): vsock/bpf: return early if transport is not assigned (CVSS 5.5, Linux)
- [CVE-2025-21669](https://cve.now/CVE-2025-21669.md): vsock/virtio: discard packets if the transport changes (CVSS 7.8, Linux)
- [CVE-2025-21668](https://cve.now/CVE-2025-21668.md): pmdomain: imx8mp-blk-ctrl: add missing loop break condition (no CVSS, Linux)
- [CVE-2025-21667](https://cve.now/CVE-2025-21667.md): iomap: avoid avoid truncating 64-bit offset to 32 bits (CVSS 5.5, Linux)
- [CVE-2025-21666](https://cve.now/CVE-2025-21666.md): vsock: prevent null-ptr-deref in vsock\_\*\[has\_data|has\_space\] (CVSS 5.5, Linux)
- [CVE-2025-21665](https://cve.now/CVE-2025-21665.md): filemap: avoid truncating 64-bit offset to 32 bits (CVSS 5.5, Linux)
- [CVE-2024-57948](https://cve.now/CVE-2024-57948.md): mac802154: check local interfaces before deleting sdata list (no CVSS, Linux)
- [CVE-2024-12037](https://cve.now/CVE-2024-12037.md): Frontend Content Forms for User Submissions (UGC) \<= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, themekraft Post Form – Registration Form – Profile Form for…)
- [CVE-2024-13662](https://cve.now/CVE-2024-13662.md): eHive Objects Image Grid \<= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, vernonsystems eHive Objects Image Grid)
- [CVE-2024-12415](https://cve.now/CVE-2024-12415.md): AI Infographic Maker \<= 4.9.0 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, quantumcloud AI Infographic Maker)
- [CVE-2024-12267](https://cve.now/CVE-2024-12267.md): Drag and Drop Multiple File Upload – Contact Form 7 \<= 1.3.8.5 - Limited Arbitrary File Deletion (CVSS 5.3, glenwpcoder Drag and Drop Multiple File Upload for Contact…)
- [CVE-2024-13472](https://cve.now/CVE-2024-13472.md): WooCommerce Product Table Lite \<= 3.9.4 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting (CVSS 7.3, wcproducttable Product Table and List Builder for WooCommer…)
- [CVE-2025-24749](https://cve.now/CVE-2025-24749.md): WordPress EZPZ SAML SP Single Sign On (SSO) plugin \<= 1.2.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Overt Software Solutions EZPZ SAML SP Single Sign On)
- [CVE-2025-24718](https://cve.now/CVE-2025-24718.md): WordPress WP Sessions Time Monitoring Full Automatic Plugin \<= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, activity-log.com WP Sessions Time Monitoring Full Automatic)
- [CVE-2025-24710](https://cve.now/CVE-2025-24710.md): WordPress Gwolle Guestbook plugin \<= 4.7.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Marcel Pol Gwolle Guestbook)
- [CVE-2025-24686](https://cve.now/CVE-2025-24686.md): WordPress RegistrationMagic Plugin \<= 6.0.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Metagauss RegistrationMagic)
- [CVE-2025-24635](https://cve.now/CVE-2025-24635.md): WordPress Paytm – Donation Plugin plugin \<= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, integrationdevpaytm Paytm Payment Donation)
- [CVE-2025-24632](https://cve.now/CVE-2025-24632.md): WordPress Advanced Dynamic Pricing for WooCommerce Plugin \<= 4.9.0 -Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, algol.plus Advanced Dynamic Pricing for WooCommerce)
- [CVE-2025-24609](https://cve.now/CVE-2025-24609.md): WordPress PORTONE 우커머스 결제 Plugin \<= 3.2.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PORTONE 우커머스 결제)
- [CVE-2025-24608](https://cve.now/CVE-2025-24608.md): WordPress GD Mail Queue Plugin \<= 4.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Milan Petrovic GD Mail Queue)
- [CVE-2025-24597](https://cve.now/CVE-2025-24597.md): WordPress Barcode Generator for WooCommerce plugin \<= 2.0.2 - Sensitive Data Exposure vulnerability (CVSS 6.5, Dmitry V. (CEO of "UKR Solution") Barcode Generator for Woo…)
- [CVE-2025-24563](https://cve.now/CVE-2025-24563.md): WordPress Cleanup – Directory Listing & Classifieds plugin \<= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, themeglow Cleanup – Directory Listing & Classifieds WordPre…)
- [CVE-2025-24560](https://cve.now/CVE-2025-24560.md): WordPress Awesome Event Booking plugin \<= 2.7.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AwesomeTOGI Awesome Event Booking)
- [CVE-2025-24551](https://cve.now/CVE-2025-24551.md): WordPress Radio Buttons and Swatches for WooCommerce plugin \<= 1.1.20 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, oneteamsoftware Radio Buttons and Swatches for WooCommerce)
- [CVE-2025-24549](https://cve.now/CVE-2025-24549.md): WordPress Post Meta plugin \<= 1.0.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mahbubur Rahman Post Meta)
- [CVE-2025-24535](https://cve.now/CVE-2025-24535.md): WordPress SKT Donation plugin \<= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sonalsinha21 SKT Donation)
- [CVE-2025-24534](https://cve.now/CVE-2025-24534.md): WordPress DPortfolio plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dinamiko DPortfolio)
- [CVE-2025-23759](https://cve.now/CVE-2025-23759.md): WordPress Affiliate Tools Việt Nam plugin \<= 0.3.17 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Gavin Affiliate Tools Việt Nam)
- [CVE-2025-23671](https://cve.now/CVE-2025-23671.md): WordPress WP OpenSearch plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sav WP OpenSearch)
- [CVE-2025-23596](https://cve.now/CVE-2025-23596.md): WordPress Notifikácie.sk plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, grafeon Notifikácie.sk)
- [CVE-2025-23990](https://cve.now/CVE-2025-23990.md): WordPress Scroll Styler plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, jablonczay Scroll Styler)
- [CVE-2025-23989](https://cve.now/CVE-2025-23989.md): WordPress Internal Link Builder plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Alessandro Piconi Internal Link Builder)
- [CVE-2025-23987](https://cve.now/CVE-2025-23987.md): WordPress Designer plugin \<= 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, codegearthemes Designer)
- [CVE-2025-23985](https://cve.now/CVE-2025-23985.md): WordPress Dynamic URL SEO plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, brainvireinfo Dynamic URL SEO)
- [CVE-2025-23980](https://cve.now/CVE-2025-23980.md): WordPress Full Circle plugin \<= 0.5.7.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, James Andrews Full Circle)
- [CVE-2025-23978](https://cve.now/CVE-2025-23978.md): WordPress FlashCounter plugin \<= 1.1.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ninos FlashCounter)
- [CVE-2025-23977](https://cve.now/CVE-2025-23977.md): WordPress Post Carousel Slider plugin \<= 2.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Bhaskar Dhote Post Carousel Slider)
- [CVE-2025-23976](https://cve.now/CVE-2025-23976.md): WordPress Issuu Panel plugin \<= 2.1.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, operationsissuu Issuu Panel)
- [CVE-2025-22757](https://cve.now/CVE-2025-22757.md): WordPress CodeBard Help Desk plugin \<= 1.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CodeBard Help Desk)
- [CVE-2025-22720](https://cve.now/CVE-2025-22720.md): WordPress WpRently | WordPress plugin plugin \<= 2.2.1 - Broken Access Control vulnerability (CVSS 5.8, magepeopleteam Booking and Rental Manager)
- [CVE-2025-22564](https://cve.now/CVE-2025-22564.md): WordPress Pretty Url Plugin \<= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, faaiq Pretty Url)
- [CVE-2025-22341](https://cve.now/CVE-2025-22341.md): WordPress Hide Login+ plugin \<= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, parswp Hide Login+)
- [CVE-2025-22332](https://cve.now/CVE-2025-22332.md): WordPress CloudFlare(R) Cache Purge plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, shanaver CloudFlare(R) Cache Purge)
- [CVE-2025-22265](https://cve.now/CVE-2025-22265.md): WordPress EMI Calculator plugin \<= 1.1 - Settings Change vulnerability (CVSS 6.5, mgplugin EMI Calculator)
- [CVE-2024-44055](https://cve.now/CVE-2024-44055.md): WordPress Oshine Modules plugin \< 3.3.6 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, brandexponents Oshine Modules)
- [CVE-2024-13566](https://cve.now/CVE-2024-13566.md): WP DataTable \<= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, samsk WP DataTable)
- [CVE-2024-13157](https://cve.now/CVE-2024-13157.md): MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar \<= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS Feed (CVSS 6.4, MP3 Audio Player – Music Player, Podcast Player & Radio by…)
- [CVE-2024-13530](https://cve.now/CVE-2024-13530.md): Custom Login Page Styler \<= 7.1.1 - Missing Authorization to Authenticated (Subsciber+) Log Deletion and Session Termination (CVSS 4.3, zia-imtiaz Login Page Styler – Custom WordPress Login Page…)
- [CVE-2024-13623](https://cve.now/CVE-2024-13623.md): Order Export for WooCommerce \<= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 5.9, webfactory Order Export for WooCommerce)
- [CVE-2024-13226](https://cve.now/CVE-2024-13226.md): A5 Custom Login Page \<= 2.8.1 - Reflected XSS (CVSS 6.1, A5 Custom Login Page)
- [CVE-2024-13225](https://cve.now/CVE-2024-13225.md): ECT Home Page Products \<= 1.9 - Reflected XSS (CVSS 6.1, ECT Home Page Products)
- [CVE-2024-13224](https://cve.now/CVE-2024-13224.md): SlideDeck 1 Lite Content Slider \<= 1.4.8 - Reflected XSS (CVSS 6.1, SlideDeck 1 Lite Content Slider)
- [CVE-2024-13223](https://cve.now/CVE-2024-13223.md): Tabulate \<= 2.10.3 - Reflected XSS (CVSS 6.1, Tabulate)
- [CVE-2024-13222](https://cve.now/CVE-2024-13222.md): User Messages \<= 1.2.4 - Reflected XSS (CVSS 6.1, User Messages)
- [CVE-2024-13221](https://cve.now/CVE-2024-13221.md): Fantastic Elasticsearch \<= 4.1.0 - Reflected XSS (CVSS 6.1, Fantastic ElasticSearch)
- [CVE-2024-13220](https://cve.now/CVE-2024-13220.md): Google Map Professional \<= 1.0 - Reflected XSS (CVSS 6.1, WordPress Google Map Professional)
- [CVE-2024-13219](https://cve.now/CVE-2024-13219.md): Policy Genius \<= 2.0.4 - Reflected XSS (CVSS 6.1, Privacy Policy Genius)
- [CVE-2024-13218](https://cve.now/CVE-2024-13218.md): Fast Tube \<= 2.3.1 - Reflected XSS (CVSS 6.1, Fast Tube)
- [CVE-2024-13112](https://cve.now/CVE-2024-13112.md): WP MediaTagger \<= 4.1.1 - Reflected XSS (CVSS 6.1, WP MediaTagger)
- [CVE-2024-13101](https://cve.now/CVE-2024-13101.md): WP MediaTagger \<= 4.1.1 - Contributor+ Stored XSS (CVSS 5.4, WP MediaTagger)
- [CVE-2024-13100](https://cve.now/CVE-2024-13100.md): Woo UPS Pickup \<= 2.6.3 - Reflected XSS (CVSS 6.1, OPSI Israel Domestic Shipments)
- [CVE-2024-12872](https://cve.now/CVE-2024-12872.md): Zalomení \<= 1.5 - Admin+ Stored XSS (CVSS 4.8, Zalomení)
- [CVE-2024-12772](https://cve.now/CVE-2024-12772.md): Ninja Tables \< 5.0.17 - Admin+ Stored XSS (CVSS 6.1, Ninja Tables)
- [CVE-2024-12275](https://cve.now/CVE-2024-12275.md): CanvasFlow \<= 1.5.5 - Reflected XSS (CVSS 6.1, Canvasflow for WordPress)
- [CVE-2025-22216](https://cve.now/CVE-2025-22216.md): CVE-2025-22216 UAA Missing Zone Validation (CVSS 5.4, Cloud Foundry UAA)
- [CVE-2024-13424](https://cve.now/CVE-2024-13424.md): Ni Sales Commission For WooCommerce \<= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Commission Update (CVSS 4.3, anzia Ni Sales Commission For WooCommerce)
- [CVE-2024-13415](https://cve.now/CVE-2024-13415.md): Food Menu – Restaurant Menu & Online Ordering for WooCommerce \<= 5.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, techlabpro1 Food Menu – Restaurant Menu & Online Ordering f…)
- [CVE-2024-13504](https://cve.now/CVE-2024-13504.md): Shared Files – Frontend File Upload Form & Secure File Sharing \<= 1.7.42 - Limited Unauthenticated Stored Cross-Site Scripting via File Upload (CVSS 7.2, anssilaitila Shared Files – Frontend File Upload Form & Sec…)
- [CVE-2024-13717](https://cve.now/CVE-2024-13717.md): Contact Form and Calls To Action by vcita \<= 2.7.1 - Missing Authorization to Authenticated (Subscriber+) Contact/Widget Toggle (CVSS 4.3, Contact Form and Calls To Action by vcita)
- [CVE-2024-11886](https://cve.now/CVE-2024-11886.md): Contact Form and Calls To Action by vcita \<= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Contact Form and Calls To Action by vcita)
- [CVE-2025-0809](https://cve.now/CVE-2025-0809.md): Link Fixer \<= 3.4 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, kpgraham Link Fixer)
- [CVE-2024-13216](https://cve.now/CVE-2024-13216.md): HT Event – WordPress Event Manager Plugin for Elementor \<= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: Sponsor (CVSS 4.3, devitemsllc HT Event – WordPress Event Manager Plugin for E…)
- [CVE-2024-10867](https://cve.now/CVE-2024-10867.md): Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg \<= 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload (CVSS 5.4, visualmodo Borderless – Addons and Templates for Elementor)
- [CVE-2025-0493](https://cve.now/CVE-2025-0493.md): MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution \<= 4.2.14 - Unauthenticated Limited Local File Inclusion (CVSS 9.8, wcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…)
- [CVE-2025-0507](https://cve.now/CVE-2025-0507.md): Ticketmeo – Sell Tickets – Event Ticketing \<= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, snexed Ticketmeo – Sell Tickets – Event Ticketing)
- [CVE-2025-0470](https://cve.now/CVE-2025-0470.md): Forminator \<= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter (CVSS 6.1, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2024-13463](https://cve.now/CVE-2024-13463.md): SeatReg \<= 1.56.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, thesiim SeatReg)
- [CVE-2024-47900](https://cve.now/CVE-2024-47900.md): GPU DDK - Multiple integer overflow in DmaTransfer PMR\_DevPhysAddr functions leading to OOB writes (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2024-47899](https://cve.now/CVE-2024-47899.md): GPU DDK - PVRSRVDeviceServicesOpen use-after-free condition (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2024-47898](https://cve.now/CVE-2024-47898.md): GPU DDK - PVRSRVDeviceSyncOpen use-after-free condition (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2024-47891](https://cve.now/CVE-2024-47891.md): GPU DDK - Exploitable double free on PTL\_STREAM\_DESC object in the kernel function TLServerCloseStreamKM due to a race condition (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2024-46974](https://cve.now/CVE-2024-46974.md): GPU DDK - Arbitrary write of read-only dmabuf (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2024-13397](https://cve.now/CVE-2024-13397.md): WPRadio – WordPress Radio Streaming Plugin \<= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, casterfm WPRadio – WordPress Radio Streaming Plugin)
- [CVE-2024-13396](https://cve.now/CVE-2024-13396.md): Frictionless \<= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, spgajjar Frictionless)
- [CVE-2024-13767](https://cve.now/CVE-2024-13767.md): Live2DWebCanvas \<= 1.9.11 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1, jiangweifang Live2DWebCanvas)
- [CVE-2024-13399](https://cve.now/CVE-2024-13399.md): Gosign – Posts Slider Block \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Gosign – Posts Slider Block)
- [CVE-2023-0092](https://cve.now/CVE-2023-0092.md): An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from th (CVSS 4.9, Canonical Juju · github.com/juju/juju)
- [CVE-2022-1736](https://cve.now/CVE-2022-1736.md): Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default. (CVSS 9.8, Canonical Ubuntu's gnome-control-center)
- [CVE-2020-11936](https://cve.now/CVE-2020-11936.md): gdbus setgid privilege escalation (CVSS 3.1, Canonical Apport)
- [CVE-2022-28653](https://cve.now/CVE-2022-28653.md): Users can consume unlimited disk space in /var/crash (CVSS 7.5, Canonical Apport)
- [CVE-2024-23921](https://cve.now/CVE-2024-23921.md): ChargePoint Home Flex Command Injection (CVSS 8.8, ChargePoint Home Flex)
- [CVE-2024-23920](https://cve.now/CVE-2024-23920.md): ChargePoint Home Flex Improper Access Control (CVSS 8.8, ChargePoint Home Flex)
- [CVE-2024-23929](https://cve.now/CVE-2024-23929.md): Pioneer DMH-WT7600NEX Telematics Directory Traversal (CVSS 7.3, Pioneer DMH-WT7600NEX)
- [CVE-2024-23928](https://cve.now/CVE-2024-23928.md): Pioneer DMH-WT7600NEX Telematics Improper Certificate Validation (CVSS 6.5, Pioneer DMH-WT7600NEX)
- [CVE-2024-23937](https://cve.now/CVE-2024-23937.md): Silicon Labs Gecko OS Debug Interface Format String (CVSS 4.3, Silicon Labs Gecko OS)
- [CVE-2025-24336](https://cve.now/CVE-2025-24336.md): SXF Common Library handles input data improperly. (CVSS 3.3, General Incorporated Association OCF SXF Common Library)
- [CVE-2024-23930](https://cve.now/CVE-2024-23930.md): Pioneer DMH-WT7600NEX Media Service Improper Handling of Exceptional Conditions (CVSS 4.3, Pioneer DMH-WT7600NEX)
- [CVE-2024-42671](https://cve.now/CVE-2024-42671.md): A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicio (CVSS 6.1)
- [CVE-2024-47857](https://cve.now/CVE-2024-47857.md): SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures when using native SSH (CVSS 9.8)
- [CVE-2024-52875](https://cve.now/CVE-2024-52875.md): An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. (CVSS 8.8, GFI Kerio Control)
- [CVE-2024-53007](https://cve.now/CVE-2024-53007.md): Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API (CVSS 6.4, Bentley ProjectWise Integration Server)
- [CVE-2024-53319](https://cve.now/CVE-2024-53319.md): A heap buffer overflow in the XML Text Escaping component of Qualisys C++ SDK commit a32a21a allows attackers to cause Denial of Service (Do (CVSS 7.5)
- [CVE-2024-53320](https://cve.now/CVE-2024-53320.md): Qualisys C++ SDK commit a32a21a was discovered to contain multiple stack buffer overflows via the GetCurrentFrame, SaveCapture, and LoadProj (CVSS 9.8)
- [CVE-2024-53354](https://cve.now/CVE-2024-53354.md): Multiple SQL injection vulnerabilities in EasyVirt DCScope \<= 8.6.0 and CO2Scope \<= 1.3.0 allows remote authenticated attackers to execute a (CVSS 6.5)
- [CVE-2024-53355](https://cve.now/CVE-2024-53355.md): Multiple incorrect access control issues in EasyVirt DCScope \<= 8.6.0 and CO2Scope \<= 1.3.0 allows remote authenticated attackers, with low (CVSS 8.8)
- [CVE-2024-53356](https://cve.now/CVE-2024-53356.md): Weak JWT Secret vulnerabilitiy in EasyVirt DCScope \<= 8.6.0 and CO2Scope \<= 1.3.0 allows remote attackers to generate JWT for privilege esca (CVSS 9.8)
- [CVE-2024-53357](https://cve.now/CVE-2024-53357.md): Multiple SQL injection vulnerabilities in EasyVirt DCScope \<= 8.6.0 and CO2Scope \<= 1.3.0 allows remote authenticated attackers, with low pr (CVSS 7.5)
- [CVE-2024-53537](https://cve.now/CVE-2024-53537.md): An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager. (CVSS 9.1)
- [CVE-2024-53582](https://cve.now/CVE-2024-53582.md): An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory trav (CVSS 7.5)
- [CVE-2024-53584](https://cve.now/CVE-2024-53584.md): OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter. (CVSS 9.8)
- [CVE-2024-55062](https://cve.now/CVE-2024-55062.md): Code Injection vulnerability in EasyVirt DCScope \<= 8.6.0 and CO2Scope \<= 1.3.0 allows remote unauthenticated attackers to execute arbitrary (CVSS 9.8)
- [CVE-2024-57432](https://cve.now/CVE-2024-57432.md): macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. (CVSS 7.5)
- [CVE-2024-57433](https://cve.now/CVE-2024-57433.md): macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. (CVSS 7.5)
- [CVE-2024-57434](https://cve.now/CVE-2024-57434.md): macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. (CVSS 8.8)
- [CVE-2024-57435](https://cve.now/CVE-2024-57435.md): In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a null pointer dereferenc (CVSS 6.5)
- [CVE-2024-57587](https://cve.now/CVE-2024-57587.md): Multiple SQL injection vulnerabilities in EasyVirt DCScope \<= 8.6.0 and CO2Scope \<= 1.3.0 allows remote unauthenticated attackers to execute (CVSS 9.1)
- [CVE-2025-22957](https://cve.now/CVE-2025-22957.md): A SQL injection vulnerability exists in the front-end of the website in ZZCMS \<= 2023, which can be exploited without any authentication. (CVSS 9.8)
- [CVE-2025-22994](https://cve.now/CVE-2025-22994.md): O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings. (CVSS 6.1)
- [CVE-2025-23001](https://cve.now/CVE-2025-23001.md): A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.