CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- vcita contact form and calls to action by vcitaContact Form and Calls To Action by vcita <= 2.7.1 - Missing Authorization to Authenticated (Subscriber+) Contact/Widget Toggle4.3 Medium
- anssilaitila shared files – frontend file upload form & secure file sharingShared Files – Frontend File Upload Form & Secure File Sharing <= 1.7.42 - Limited Unauthenticated Stored Cross-Site Scripting via File Upload7.2 High
- techlabpro1 food menu – restaurant menu & online ordering for woocommerceFood Menu – Restaurant Menu & Online Ordering for WooCommerce <= 5.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update4.3 Medium
- kpgraham link fixerLink Fixer <= 3.4 - Unauthenticated Stored Cross-Site Scripting7.2 High
- vcita contact form and calls to action by vcitaContact Form and Calls To Action by vcita <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- devitemsllc ht event – wordpress event manager plugin for elementorHT Event – WordPress Event Manager Plugin for Elementor <= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: Sponsor4.3 Medium
- multivendorx, wcmp multivendorx – woocommerce multivendor marketplace solutions +1 moreMultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.14 - Unauthenticated Limited Local File Inclusion9.8 Critical
- visualmodo borderless, borderless – addons and templates for elementor +1 moreBorderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload5.4 Medium
- snexed ticketmeo – sell tickets – event ticketingTicketmeo – Sell Tickets – Event Ticketing <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 moreForminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter6.1 Medium
- thesiim seatregSeatReg <= 1.56.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- imagination technologies graphics ddkGPU DDK - Multiple integer overflow in DmaTransfer PMR_DevPhysAddr functions leading to OOB writes7.8 High
- imagination technologies graphics ddkGPU DDK - PVRSRVDeviceServicesOpen use-after-free condition7.8 High
- imagination technologies graphics ddkGPU DDK - PVRSRVDeviceSyncOpen use-after-free condition7.8 High
- imagination technologies graphics ddkGPU DDK - Exploitable double free on PTL_STREAM_DESC object in the kernel function TLServerCloseStreamKM due to a race condition7.8 High
- imagination technologies graphics ddkGPU DDK - Arbitrary write of read-only dmabuf7.8 High
- casterfm wpradio – wordpress radio streaming pluginWPRadio – WordPress Radio Streaming Plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- spgajjar frictionlessFrictionless <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- jiangweifang live2dwebcanvasLive2DWebCanvas <= 1.9.11 - Authenticated (Subscriber+) Arbitrary File Deletion8.1 High
- gosign – posts slider blockGosign – Posts Slider Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- chargepoint home flex, home flex hardwired firmware, home flex nema 14-50 plug firmware +1 more +3 moreChargePoint Home Flex Command Injection8.8 High
- chargepoint home flex, home flex hardwired firmware, home flex nema 14-50 plug firmware +1 more +3 moreChargePoint Home Flex Improper Access Control8.8 High
- pioneer dmh-wt7600nex, dmh-wt7600nex firmware +1 morePioneer DMH-WT7600NEX Telematics Directory Traversal7.3 High
- pioneer dmh-wt7600nex, dmh-wt7600nex firmware +1 morePioneer DMH-WT7600NEX Telematics Improper Certificate Validation6.5 Medium
- silabs gecko osSilicon Labs Gecko OS Debug Interface Format String4.3 Medium
- general incorporated association ocf sxf common librarySXF Common Library handles input data improperly. If a product using the library reads a crafted...3.3 Low
- pioneer dmh-wt7600nex, dmh-wt7600nex firmware +1 morePioneer DMH-WT7600NEX Media Service Improper Handling of Exceptional Conditions4.3 Medium
- No product listedA Host Header Injection vulnerability exists in CTFd 3.7.5, due to the application failing to...6.1 Medium
- zoneland o2oaO2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings.6.1 Medium
- zzcmsA SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can...9.8 Critical
- easyvirt co2scope, dcscope +1 moreEasyVirt DCScope 8.6.0 and earlier and co2Scope 1.3.0 and earlier are vulnerable to SQL Injection...9.1 Critical
- macrozheng mall-tinyIn macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation...6.5 Medium
- macrozheng mall-tinymacrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users...8.8 High
- macrozheng mall-tinymacrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function....7.5 High
- macrozheng mall-tinymacrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys...7.5 High
- easyvirt co2scope, dcscope +1 moreEasyVirt DCScope 8.6.0 and earlier and co2Scope 1.3.0 and earlier are vulnerable to Command...9.8 Critical
- openpanelOpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone...9.8 Critical
- openpanelAn issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4...7.5 High
- openpanelAn issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File...9.1 Critical
- easyvirt co2scope, dcscope +1 moreIn EasyVirt DCScope <=8.6.0 and CO2Scope <=1.3.0, the AES encryption keys used to encrypt...7.5 High
- easyvirt co2scope, dcscope +1 moreEasyVirt DCScope <=8.6.0 and CO2Scope <=1.3.0 are vulnerable to privilege escalation as the...9.8 Critical
- easyvirt co2scope, dcscope +1 moreEasyVirt DCScope <=8.6.0 and CO2Scope <=1.3.0 are vulnerable to Incorrect Access Control. This...8.8 High
- easyvirt co2scope, dcscope +1 moreEasyVirt DCScope <=8.6.0 and CO2Scope <=1.3.0 are vulnerable to SQL Injection.6.5 Medium
- No product listedQualisys C++ SDK commit a32a21a was discovered to contain multiple stack buffer overflows via the...9.8 Critical
- No product listedA heap buffer overflow in the XML Text Escaping component of Qualisys C++ SDK commit a32a21a...7.5 High
- bentley projectwise integration serverBentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query...6.4 Medium
- gfi kerio controlAn issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed...8.8 High
- No product listedSSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on...9.8 Critical
- No product listedA Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a...6.1 Medium
- alpine halo9, alpsalpine ilx-f509 firmware +1 moreAlpine Halo9 Stack-based Buffer Overflow8.0 High
- Show moreLoading…