Skip to content
OpenAdvisories

Archive

7 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /7 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

23 results · Clear filters · Feed

  • Critical 9.8
    CVE-2018-4301

    This issue is fixed in SCSSU-201801. A potential stack based buffer overflow existed in GemaltoKeyHandle.cpp.

    Apple Smart Card Services
  • Critical 10.0
    CVE-2025-22133

    WeGIA Allows Arbitrary File Upload with Remote Code Execution (RCE)

    WeGIA is a web manager for charitable institutions. Prior to 3.2.8, a critical vulnerability was identified in the /WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. The endpoint accepts file uploads without proper validation, allowing the uploa…

    nilsonLazarin WeGIA
  • Critical 9.8
    CVE-2025-0247 EPSS 11%

    Memory safety bugs fixed in Firefox 134 and Thunderbird 134

    Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefo…

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  • Critical 9.8
    CVE-2025-21624

    ClipBucket V5 Playlist Cover File Upload to Remote Code Execution

    ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the application, specifically surrounding the uploading of playlist cover images. Without proper checks…

    MacWarrior clipbucket-v5
  • Critical 10.0
    CVE-2024-43243

    WordPress JobBoard Job listing plugin <= 1.2.6 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in themeglow JobBoard Job listing job-board-light allows Upload a Web Shell to a Web Server.This issue affects JobBoard Job listing: from n/a through <= 1.2.6.

    themeglow JobBoard Job listing
  • Critical 9.8
    CVE-2024-49222

    WordPress WPGuppy plugin <= 1.1.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a through <= 1.1.0.

    AmentoTech Private WPGuppy
  • Critical 9.8
    CVE-2024-49649

    WordPress Build App Online plugin <= 1.0.23 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through <= 1.0.…

    hakeemnala Build App Online
  • Critical 9.1
    CVE-2024-56278 Public exploit

    WordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows PHP Remote File Inclusion.This issue affects WP Ultimate Exporter: from n/a through <= 2.9.1.

    Smackcoders WP Ultimate Exporter
  • Critical 9.3
    CVE-2024-56284

    WordPress SSL Wireless SMS Notification Plugin <= 3.5.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows SQL Injection.This issue affects SSL Wireless SMS Notification: from n/a throug…

    sslplugins SSL Wireless SMS Notification
  • Critical 9.3
    CVE-2024-56290

    WordPress Multiple Shipping And Billing Address For Woocommerce Plugin <= 1.2 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce different-shipping-and-billing-address-for-woocommerce allows SQL Injection.This issue…

    silverplugins217 Multiple Shipping And Billing Address For Woocommerce Web / CMS
  • Critical 9.8
    CVE-2024-8855

    WordPress Auction <= 3.7 - Editor+ SQL Injection

    The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks

    Web / CMS
  • Critical 9.8
    CVE-2024-12470

    School Management System – SakolaWP <= 1.0.8 - Unauthenticated Privilege Escalation

    The School Management System – SakolaWP plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.8. This is due to the registration function not properly limiting what roles a user can register as. This makes it pos…

    Themes Awesome School Management System – SakolaWP Web / CMS
  • Critical 9.8
    CVE-2024-12264

    PayU CommercePro Plugin <= 3.8.3 - Unauthenticated Privilege Escalation

    The PayU CommercePro Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.8.3. This is due to /wp-json/payu/v1/generate-user-token and /wp-json/payu/v1/get-shipping-cost REST API endpoints not properly veri…

    payuplugin PayU CommercePro Plugin Web / CMS
  • Critical 9.8
    CVE-2024-12252 Public exploit

    SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)

    The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remote_update AJAX action in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to overwrite the se…

    seobeginner SEO LAT Auto Post Web / CMS
  • Critical 9.8
    CVE-2024-12402

    Themes Coder – Create Android & iOS Apps For Your Woocommerce Site <= 1.3.4 - Insecure Direct Object Reference to Password Change/Account Takeover/Privilege Escalation

    The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.4. This is due to the plugin not properly validating a user's iden…

    themescoder TC Ecommerce – Create Android & iOS Apps for WooCommerce Android iOS Web / CMS
  • Critical 9.8
    CVE-2022-41573

    An issue was discovered in Ovidentia 8.3. The file upload feature does not prevent the uploading of executable files. A…

  • Critical 9.8
    CVE-2022-41572

    An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Privilege escalation can be accomplished on the server b…

  • Critical 9.8
    CVE-2024-55556 Public exploit EPSS 44%

    A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote co…

  • Critical 9.8
    CVE-2024-55414

    A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged …

  • Critical 9.8
    CVE-2024-50658

    Server-Side Template Injection (SSTI) was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code v…

  • Critical 9.8
    CVE-2024-50660

    File Upload Bypass was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the file upload …

  • Critical 9.1
    CVE-2024-35532

    An XML External Entity (XXE) injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attack…

  • Critical 9.1
    CVE-2024-54819 Public exploit EPSS 21%

    I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input vali…