CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- asif shakeel sticky buttonWordPress Sticky Button plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- mdjm mobile dj managerWordPress MDJM Event Management Plugin <= 1.7.5.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound bauernregelnWordPress Bauernregeln Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- martinjuhasz one backend languageWordPress One Backend Language Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound network-favoritesWordPress Network-Favorites plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- casey bisson gigaom sphinxWordPress Gigaom Sphinx plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound quote meWordPress Quote me plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound cbx accounting & bookkeepingWordPress CBX Accounting & Bookkeeping plugin <= 1.3.14 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- algothemes causes – donation pluginWordPress Causes – Donation plugin <= 1.0.01 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- humanmade limited, joe hoyle, tom wilmott, matthew haines-young hm portfolioWordPress HM Portfolio plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- david anderson / team updraft redux converterWordPress Redux Converter plugin <= 1.1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- moaluko store locatorWordPress Store Locator plugin <= 3.98.10 - Local File Inclusion vulnerability7.5 High
- come2theweb simple gallery with filterSimple Gallery with Filter <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bmltenabled meeting map, otrok7 bmlt meeting map +1 moreBMLT Meeting Map <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- eminozlem bootstrap ultimate, g5plus ultimate bootstrap elements for elementor +1 moreBootstrap Ultimate <= 1.4.9 - Unauthenticated Limited Local File Inclusion9.8 Critical
- sperse automate hub free by sperse.io, automate hub +1 moreAutomate Hub Free by Sperse.IO <= 1.7.0 - Cross-Site Request Forgery to Activation Status Update4.3 Medium
- codepeople form builder cpForm Builder CP <= 1.2.41 - Authenticated (Contributor+) SQL Injection6.5 Medium
- listamesterListamester <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- gitlabInsufficient Granularity of Access Control in GitLab6.4 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- deepin dde-api-proxyAn issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can...8.4 High
- go standard library crypto/x509ParsePKCS1PrivateKey panic with partial keys in crypto/x5097.5 High
- No product listedInnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.5.7 Medium
- gpacAn issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box. It contains a heap-based...5.5 Medium
- go-admin go-cmsSQL injection vulnerability in Go-CMS v.1.1.10 allows a remote attacker to execute arbitrary code...6.8 Medium
- nodebbNodeBB Cross-site scripting (XSS) vulnerability4.6 Medium
- oneidentity identity managerIn One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR)...9.9 Critical
- sungrowpower winet-s firmwareSunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow...9.8 Critical
- sungrowpower winet-s firmwareIn SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code...8.1 High
- sungrowpower winet-s firmwareSunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow...9.8 Critical
- sungrowpower winet-s firmwareIn SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an...9.8 Critical
- sungrowpower winet-s firmwareSunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that...5.4 Medium
- sungrowpower winet-s firmwareSunGrow WiNet-SV200.001.00.P027 and earlier versions contains a hardcoded password that can be...6.5 Medium
- go toolchain cmd/goGOAUTH credential leak in cmd/go8.8 High
gpacDebianGPAC MP4box 2.1-DEV-rev574-g9d5bb184b contains a buffer overflow in gf_vvc_read_pps_bs_internal...7.8 High- replicated classicSensitive data unnecessarily returned from authenticated API4.9 Medium
astevalPyPI,rootio-astevalRoot +1 moreASTEVAL Allows Malicious Tampering of Exposed AST Nodes Leads to Sandbox Escape8.4 High- aws sign-in iam login flowIssue with AWS Sign-in IAM User Login Flow - Possible Username Enumeration6.9 Medium
- fedora repository repository, fedorarepository fcrepo +1 moreFedora Repository fedoraIntCallUser default credentials8.7 High
- fedora repository repository, fedorarepository fcrepo +1 moreFedora Repository archive extraction path traversal8.7 High
silverstripe/frameworkPackagistReflected Cross Site Scripting (XSS) in error messageNo score- directusDirectus privilege escalation vulnerability using Share feature5.0 Medium
- fastify fastify-multipart@fastify/multipart vulnerable to unlimited consumption of resources7.5 High
- himmelblau-idm himmelblauHimmelblau leaks credentials in the debug log3.2 Low
- xerox workplace suiteWeak default folder permissions6.7 Medium
- ibm security verify bridgeIBM Security Verify Bridge data manipulation6.0 Medium
- xerox workplace suiteMail spoofing5.3 Medium
- xerox workplace suiteClear text secrets returned & Remote system secrets in clear text6.5 Medium
- xerox workplace suiteFlawed token generation implementation & Hard-coded key implementation7.6 High
- ibm tivoli application dependency discovery managerIBM Tivoli Application Dependency Discovery Manager cross-site scripting6.4 Medium
- Show moreLoading…