CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- malcolm-oph stageshowStageShow <= 9.8.6 - Reflected Cross-Site Scripting6.1 Medium
- spanrig embed swagger uiEmbed Swagger UI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wptableeditor table editorTable Editor <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- edigermatthew wonder fontawesomeWonder FontAwesome <= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- deviodigital wp dispensaryWP Dispensary <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- visualmodo borderless, borderless – addons and templates for elementor +1 moreBorderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.9 - Missing Authorization to Icon Font Deletion4.3 Medium
- axiomatic bento4Axiomatic Bento4 Ap4DataBuffer.h GetData heap-based overflow6.3 Medium
- cianet onu gw24acCianet ONU GW24AC Login cross site scripting5.3 Medium
- atakan au automatically hierarchic categories in menuAutomatically Hierarchic Categories in Menu <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- alexreservations alex reservations: smart restaurant bookingAlex Reservations: Smart Restaurant Booking <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- ibm app connect enterprise certified containerIBM App Connect Enterprise Certified Container improper communications restriction6.8 Medium
custom-req-on-workerscrates.io`custom-req-on-workers` was removed from crates.io for malicious codeNo scorejfrog_quotescrates.io`jfrog_quotes` was removed from crates.io for malicious codeNo score- embedaiStored Cross-Site vulnerability in EmbedAI8.6 High
- embedaiReflected Cross-Site Scripting vulnerability in EmbedAI6.1 Medium
- embedaiImproper Access Control vulnerability in EmbedAI7.5 High
- embedaiImproper Access Control vulnerability in EmbedAI7.5 High
- embedaiImproper Access Control vulnerability in EmbedAI5.3 Medium
- embedaiImproper Access Control vulnerability in EmbedAI5.8 Medium
- embedaiImproper Access Control vulnerability in EmbedAI5.8 Medium
- embedaiImproper Access Control vulnerability in EmbedAI8.6 High
- embedaiImproper Access Control vulnerability in EmbedAI8.6 High
- filipmedia wp image uploaderWP Image Uploader <= 1.0.1 - Reflected Cross-Site Scripting6.1 Medium
- smub contact form & smtp plugin for wordpress by pirateformsContact Form & SMTP Plugin for WordPress by PirateForms <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- simplepress simple:press forum, simplepress +1 moreSimple:Press Forum <= 6.10.11 - Reflected Cross-Site Scripting6.1 Medium
- clinked client portalClinked Client Portal <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- sonicwall netextenderA vulnerability in the NetExtender Windows client log export function allows unauthorized access...5.5 Medium
- vicente ruiz gálvez vr-frasesVR-Frases (collect & share quotes) <= 3.0.1 - Authenticated (Admin+) SQL Injection4.9 Medium
- vicente ruiz gálvez vr-frasesVR-Frases (collect & share quotes) <= 3.0.1 - Reflected Cross-Site Scripting6.1 Medium
- dell networkerDell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions contain(s)...7.8 High
- wondershare dr.foneWondershare Dr.Fone Privilege Scalation Vulnerability7.8 High
- codepeople cp contact form with paypal, dwbooster cp contact form +1 moreCP Contact Form with PayPal <= 1.3.52 - Cross-Site Request Forgery6.5 Medium
- moreconvert woocommerce wishlist, wishlist for woocommerce +1 moreWooCommerce Wishlist <= 1.8.7 - Unauthenticated Wishlist Disclosure via download_pdf_file Function7.5 High
- cyberchimps responsive blocks, responsive blocks – page builder for blocks & patterns +1 moreResponsive Blocks – WordPress Gutenberg Blocks <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via section_tag Parameter6.4 Medium
- kstover ninja forms – the contact form builder that grows with you, ninjaforms ninja forms +1 moreNinja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- motopress stratum, jetmonsters stratum widgets for elementor +1 moreStratum – Elementor Widgets <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot Widget6.4 Medium
- liquidweb event tickets, stellarwp event tickets and registration +1 moreEvent Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure5.3 Medium
- unknown bulk me now!, ombu bulk me now\! +1 moreBulk Me Now <= 2.0 - Message Deletion via CSRF4.3 Medium
- unknown bulk me now!, ombu bulk me now\! +1 moreBulk Me Now <= 2.0 - Stored XSS via Shortcode7.1 High
- unknown bulk me now!, ombu bulk me now\! +1 moreBulk Me Now <= 2.0 - Reflected XSS7.1 High
- goodlayers tourmaster, tour master +1 moreTourmaster < 5.3.5 - Reflected XSS7.1 High
- goodlayers core, unknown goodlayers-core +1 moreGoodLayers Core < 2.1.3 - Subscriber+ Stored XSS via SVG Upload6.5 Medium
- data443 tracking code managerTracking Code Manager < 2.4.0 - Contributor+ Stored XSS5.9 Medium
- mit kerberos 5In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer...7.1 High
- ethereumicoio ethereumicoEthereumICO <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ethereum-ico Shortcode6.4 Medium
- freebsdUninitialized kernel memory disclosure via ktrace(2)4.9 Medium
- freebsdUnprivileged access to system files6.5 Medium
- freebsdBuffer overflow in some filesystems via NFS6.0 Medium
- dell enterprise sonic os, enterprise sonic distribution +1 moreDell Networking Switches running Enterprise SONiC OS, version(s) prior to 4.4.1 and 4.2.3,...8.0 High
- campcodes school management softwareCampCodes School Management Software Staff edit-staff improper authorization5.3 Medium
- Show moreLoading…