CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- clickwhale – link manager, link shortener and click tracker for affiliate links & link pages, flowdee clickwhale +1 moreClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- anisha job recruitmentcode-projects Job Recruitment _call_job_search_ajax.php cross site scripting6.9 Medium
- code-projects gym management systemCodezips Gym Management System submit_plan_new.php sql injection6.9 Medium
- mayurik best employee management systemSourceCodester Best Employee Management System Administrative Endpoint View_user.php access control6.9 Medium
- rodrigue exif viewer classicThe old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by...6.1 Medium
- argie online coursewareSourceCodester Online Courseware Edit Teacher saveeditt.php cross site scripting5.1 Medium
- microworld escan antivirus, escanav escan anti-virus +1 moreMicroWorld eScan Antivirus Quarantine rtscanner os command injection9.2 Critical
- ibm security verify governanceIBM Security Verify Governance information disclosure4.4 Medium
- microworld escan antivirus, escanav escan anti-virus +1 moreMicroWorld eScan Antivirus Quarantine Microworld default permission4.8 Medium
- esafenet cdgESAFENET CDG todolistjump.jsp cross site scripting5.3 Medium
- esafenet cdgESAFENET CDG todoDetail.jsp cross site scripting5.3 Medium
- esafenet cdgESAFENET CDG todoDetail.jsp sql injection5.3 Medium
libxml2OSS-FuzzStack-buffer-overflow in xmlValidateElementContentNo score- esafenet cdgESAFENET CDG sdTodoDetail.jsp sql injection5.3 Medium
- ibm security verify governanceIBM Security Verify Governance information5.9 Medium
- akamai enterprise application accessAn issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an...8.0 High
- axiosIn axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining...0.0 None
- heyewei jfinalcmsJFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The...9.8 Critical
- No product listedA floating-point exception (FPE) vulnerability exists in the AP4_TfraAtom::AP4_TfraAtom function...6.5 Medium
- No product listedBuffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows...7.8 High
- No product listedBuffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows...7.8 High
- ruoyiRuoYi vulnerable to Denial of Service by attackers with admin privileges4.9 Medium
- ruoyiRuoYi has insecure permissions5.4 Medium
- ruoyiRuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at...6.5 Medium
- ruoyiRuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring7.2 High
- No product listedPassword Vulnerability in Safety production process management system v1.0 allows a remote...9.8 Critical
- sismics teedyWhen LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of...9.8 Critical
- sismics teedyTeedy <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF...8.8 High
- celk saudeHTML Injection vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to...6.1 Medium
- celk saudeThe specific component in Celk Saude 3.1.252.1 that processes user input and returns error...8.8 High
- No product listedThe /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG...7.5 High
- isc bind 9DNS-over-HTTPS implementation suffers from multiple issues under heavy query load7.5 High
- isc bind 9Many records in the additional section cause CPU exhaustion7.5 High
- esafenet cdgESAFENET CDG sdDoneDetail.jsp sql injection5.3 Medium
- esafenet cdgESAFENET CDG doneDetail.jsp cross site scripting5.3 Medium
- esafenet cdgESAFENET CDG doneDetail.jsp sql injection5.3 Medium
- esafenet cdgESAFENET CDG content_top.jsp sql injection5.3 Medium
- esafenet cdgESAFENET CDG appDetail.jsp cross site scripting5.3 Medium
- esafenet cdgESAFENET CDG appDetail.jsp sql injection5.3 Medium
- apache hiveApache Hive: Credentials file created with non restrictive permissions5.5 Medium
- esafenet cdgESAFENET CDG SysConfig.jsp cross site scripting5.3 Medium
- rockwell automation factorytalk® view site editionFactoryTalk® View Site Edition - Local Code Injection7.0 High
- rockwell automation factorytalk® view site editionFactoryTalk® View Site Edition - Incorrect Permission Assignment7.0 High
- acronis snap deployLocal privilege escalation due to insecure folder permissions. The following products are...6.7 Medium
@sentry/astronpm,@sentry/aws-serverlessnpm,@sentry/bunnpm +8 more +10 morePotential DoS when using ContextLines integration3.7 Low- intelbras incontrol, incontrol web +1 moreIntelbras InControl Registered User usuario cleartext transmission6.3 Medium
- typo3 oidcTYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)4.2 Medium
- rockwell automation factorytalk® view machine editionFactoryTalk® View Machine Editon - Remote Code Execution9.3 Critical
- rockwell automation factorytalk view machine editionFactoryTalk® View Machine Edition - Local Code Injection8.6 High
- rockwell automation compact guardlogix 5380 sil 3, guardlogix 5580 sil 3 +1 more5380/5580 Denial-of-Service Vulnerability7.1 High
- Show moreLoading…