CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- markugwuanyi contentoptin liteWordPress ContentOptin Lite plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- explara membershipWordPress Explara Membership plugin <= 0.0.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- bastien ho custom css addonsWordPress Custom CSS Addons plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound xlsxviewerWordPress XLSXviewer plugin <= 2.1.1 - Arbitrary File Deletion vulnerability7.5 High
- bilal tas responsivityWordPress Responsivity plugin <= 0.0.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- clickandsell real wordpress sidebarWordPress REAL WordPress Sidebar plugin <= 0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- 118group team 118group agentWordPress Team 118GROUP Agent plugin <= 1.6.0 - Arbitrary Content Deletion vulnerability7.5 High
- siteheart hypercommentsWordPress HyperComments plugin <= 0.9.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- blrt wp embedWordPress Blrt WP Embed plugin <= 1.6.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound customizable captcha and contact usWordPress Customizable Captcha and Contact us plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- faaiq simple custom post type custom fieldWordPress Simple Custom post type custom field plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- contentlocalized translation.proWordPress Translation.Pro plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- chetan khandla woocommerce order searchWordPress WooCommerce Order Search plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- prestashop ps contactinfops_contactinfo has potential XSS due to usage of the nofilter tag in template6.2 Medium
- siemens ruggedcom rox mx5000, ruggedcom rox mx5000re, ruggedcom rox rx1400 +12 more +14 moreWhen the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate...6.2 Medium
- gamipress, rubengc gamipress – gamification plugin to reward points, achievements, badges & ranks in wordpress +1 moreGamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter7.5 High
- thimpress wp hotel bookingWP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval4.3 Medium
- gamipress, rubengc gamipress – gamification plugin to reward points, achievements, badges & ranks in wordpress +1 moreGamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function7.3 High
- gamipress, rubengc gamipress – gamification plugin to reward points, achievements, badges & ranks in wordpress +1 moreGamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function7.3 High
- linux, linux kernel +1 morenetfilter: nf_set_pipapo: fix initial map fill9.8 Critical
- fortinet fortimanager, fortiadc, fortianalyzer +15 more +17 moreA externally controlled reference to a resource in another sphere in Fortinet FortiManager before...4.1 Medium
- aipower, senols ai puffer – your ai engine for wordpress (formerly ai power) +1 moreAI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_ai_forms7.2 High
- aipower, senols ai puffer – your ai engine for wordpress (formerly ai power) +1 moreAI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts7.2 High
- themify builder, themifyme themify builder +1 moreThemify Builder <= 7.6.5 - Reflected Cross-Site Scripting6.1 Medium
- aipower, senols ai puffer – your ai engine for wordpress (formerly ai power) +1 moreAI Power: Complete AI Pack <= 1.8.96 - Authenticated (Subscriber+) Server-Side Request Forgery5.4 Medium
- aipower, senols ai puffer – your ai engine for wordpress (formerly ai power) +1 moreAI Power: Complete AI Pack <= 1.8.96 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution6.3 Medium
- scriptsbundle adforestAdForest <= 5.1.8 - Authentication Bypass9.8 Critical
- bfintal stackable – page builder gutenberg blocks, gambit stackable +1 moreStackable – Page Builder Gutenberg Blocks <= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- icopydoc xml for google merchant centerXML for Google Merchant Center <= 3.0.11 - Reflected Cross-Site Scripting6.1 Medium
- i-o data device, inc. ud-lt2Improper neutralization of special elements used in an OS command ('OS Command Injection') issue...6.6 Medium
- i-o data device, inc. ud-lt2Inclusion of undocumented features issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. A...7.5 High
- i-o data device, inc. ud-lt2Improper neutralization of special elements used in an OS command ('OS Command Injection') issue...7.2 High
- quantumcloud wpbot pro wordpress chatbot, wpot +1 moreWPBot Pro Wordpress Chatbot <= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation4.3 Medium
- ayecode ketchup shortcodesKetchup Shortcodes <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- videowhisper picture gallery – frontend image uploads, ajax photo list, picture gallery +1 morePicture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
containerized-data-importeropenSUSESecurity update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, cont…No scorecontainerized-data-importerSUSESecurity update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, cont…No scorekubevirtopenSUSESecurity update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t…No scorekubevirtSUSESecurity update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t…No score- gamerz wp-pollsWP-Polls <= 2.77.2 - Unauthenticated SQL Injection to Stored Cross-Site Scripting5.4 Medium
- nodejs nodeWith the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker...7.7 High
- campcodes school management softwareCampCodes School Management Software Attachment resource injection2.3 Low
assimpOSS-FuzzUNKNOWN READ in Assimp::SceneCombiner::CopySceneNo scorelibicalOSS-FuzzUse-of-uninitialized-value in icalmemory_strdupNo scoreopencvOSS-FuzzHeap-buffer-overflow in std::__1::__function::__func<cv::PngDecoder::compose_frameNo score- slims senayan library management system bulianA SQL Injection vulnerability exists in Senayan Library Management System SLiMS 9 Bulian 9.6.1...6.7 Medium
- codeastro internet banking systemA Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0...7.3 High
- silverpeasCross site scripting in Silverpeas Core5.4 Medium
- dlink dsl-3782 firmwareD-Link DSL-3782 v1.01 is vulnerable to Buffer Overflow in /New_GUI/ParentalControl.asp.5.7 Medium
- No product listedIn Thermo Fisher Scientific Xcalibur before 4.7 SP1 and Thermo Foundation Instrument Control...7.8 High
- Show moreLoading…