CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- thimpress wp hotel bookingWP Hotel Booking <= 2.1.5 - Missing Authorization5.3 Medium
- scribit proofreadingProofreading <= 1.2.1.1 - Reflected Cross-Site Scripting6.1 Medium
- brandondove rss icon widgetRSS Icon Widget <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- katsushi-kawamori moving usersMoving Users <= 1.05 - Unauthenticated Sensitive Information Exposure5.3 Medium
- zookatron mybookprogress by stormhill mediaMyBookProgress by Stormhill Media <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via book Parameter6.4 Medium
- tobig quote-posttype-pluginquote-posttype-plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- barteled sandboxSandbox <= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Download6.5 Medium
- barteled sandboxSandbox <= 0.4 - Reflected Cross-Site Scripting6.1 Medium
- glofoxwebdev glofox shortcodesGlofox Shortcodes <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- advancedfilemanager advanced file manager, saadiqbal advanced file manager — ultimate wordpress file manager and document library plugin +1 moreAdvanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload7.5 High
- imithemes eventer, eventer - wordpress event & booking manager plugin +1 moreEventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read6.5 Medium
- i3 verticals truefilingTrueFiling authorization bypass via user-controlled keys6.3 Medium
- naa986 checkout for paypalCheckout for PayPal <= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- chuck1982 wp inventory manager, wp inventory manager +1 moreWP Inventory Manager <= 2.3.2 - Reflected Cross-Site Scripting6.1 Medium
- naa986 payment button for paypalPayment Button for PayPal <= 1.2.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- ibm qradar wincollect agent, qradar wincollect +1 moreIBM QRadar WinCollect Agent data manipulation4.0 Medium
- ibm infosphere information serverIBM InfoSphere Information Server directory traversal6.5 Medium
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 22h2 +10 more +12 moreWindows Secure Kernel Mode Elevation of Privilege Vulnerability7.8 High
- fuji electric alpha5 smartFuji Electric Alpha5 SMART Stack-Based Buffer Overflow8.5 High
- No product listedCross Site Scripting vulnerability in InformationPush master version allows a remote attacker to...6.1 Medium
- No product listedCross Site Scripting vulnerability in sunnygkp10 Online Exam System master version allows a...6.1 Medium
- typechoClickjacking vulnerability in typecho v1.2.1.6.4 Medium
- otcmsOtCMS <=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can...4.3 Medium
- wegiaWeGIA v3.2.0 is vulnerable to SQL Injection viathe nextPage parameter in /controle/control.php.9.8 Critical
- wegiaWeGIA < 3.2.0 is vulnerable to SQL Injection in query_geracao_auto.php via the query parameter.9.8 Critical
- wegiaWeGIA < 3.2.0 is vulnerable to Cross Site Scripting (XSS) via the dados_addInfo parameter of...6.1 Medium
- wegiaWeGIA < 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application...9.8 Critical
- wegiaWeGIA < 3.2.0 is vulnerable to SQL Injection in /funcionario/remuneracao.php via the...9.8 Critical
- wegiaWegia < 3.2.0 is vulnerable to Cross Site Scripting (XSS) in /geral/documentos_funcionario.php...8.1 High
- No product listedTeradata Vantage Editor 1.0.1 is mostly intended for SQL database access and docs.teradata.com...7.1 High
- No product listedThe /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access...6.5 Medium
- nvidia gpu display driver, vgpu softwareNVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written...7.1 High
- nvidia gpu display driver, vgpu softwareNVIDIA GPU kernel driver for Windows and Linux contains a vulnerability where a potential user...4.4 Medium
- closed social.ninjaWordPress SOCIAL.NINJA plugin <= 0.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- metaphorcreations metaphor widgetsWordPress Metaphor Widgets plugin <= 2.4 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- ujjaval jani copy move postsWordPress Copy Move Posts plugin <= 1.6 - Broken Access Control vulnerability5.3 Medium
- linickx root cookieWordPress root Cookie plugin <= 1.6 - CSRF to Stored XSS vulnerability7.1 High
- ciprian turcu auto ftpWordPress Auto FTP plugin <= 1.0.1 - CSRF to Stored Cross-Site Scripting vulnerability7.1 High
- alex volkov woo tunerWordPress Woo Tuner plugin <= 0.1.2 - Broken Access Control vulnerability5.4 Medium
- alex volkov chatterWordPress Chatter plugin <= 1.0.1 - CSRF to Stored XSS vulnerability7.1 High
- sur.lyWordPress Sur.ly plugin <= 3.0.3 - Broken Access Control vulnerability4.3 Medium
- kopatheme kopa nictitate toolkitWordPress Kopa Nictitate Toolkit plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp tasker wordpress graphs & chartsWordPress WordPress Graphs & Charts Plugin <= 2.0.8 - Broken Access Control vulnerability5.4 Medium
- xolaWordPress Xola plugin <= 1.6 - Broken Access Control vulnerability4.3 Medium
- flymke mark postsWordPress Mark Posts plugin <= 2.2.4 - Broken Access Control vulnerability5.4 Medium
- goldstarWordPress Goldstar plugin <= 2.1.1 - Broken Access Control vulnerability4.3 Medium
- awcode salvador – ai image generatorWordPress Salvador – AI Image Generator plugin <= 1.0.11 - Broken Access Control vulnerability4.3 Medium
- khan-it image switcherWordPress Image Switcher plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ezmarketing ezplayerWordPress EZPlayer plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- le pixel solitaire enhanced youtube shortcodeWordPress Enhanced YouTube Shortcode plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…