Skip to content
OpenAdvisories

Archive

9 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /9 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

36 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-13285

    wkhtmltopdf - Highly critical - Unsupported - SA-CONTRIB-2024-049

    Vulnerability in Drupal wkhtmltopdf.This issue affects wkhtmltopdf: *.*.

    Drupal wkhtmltopdf drupal/wkhtmltopdf Packagist
  • Critical 9.1
    CVE-2024-13281

    Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045

    Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2.

    Drupal Monster Menus drupal/monster_menus Packagist
  • Critical 9.8
    CVE-2024-13280

    Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044

    Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.

    Drupal Persistent Login drupal/persistent_login Packagist
  • Critical 9.8
    CVE-2024-13279

    Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043

    Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Critical 9.1
    CVE-2024-13278

    Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042

    Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.

    Drupal Diff drupal/diff Packagist
  • Critical 9.1
    CVE-2024-13277

    Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041

    Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1.

    Drupal Smart IP Ban
  • Critical 9.8
    CVE-2024-10215

    WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change

    The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. …

    Iqonic Design WPBookit Web / CMS
  • Critical 9.8
    CVE-2024-13264

    Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.

    Drupal Opigno module drupal/opigno_module Packagist
  • Critical 9.8
    CVE-2024-13258

    Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022

    Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.

    Drupal Drupal REST & JSON API Authentication drupal/rest_api_authentication Web / CMS Packagist
  • Critical 9.1
    CVE-2024-13253

    Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017

    Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.

    Drupal Advanced PWA inc Push Notifications drupal/advanced_pwa Packagist
  • Critical 9.1
    CVE-2024-13242

    Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006

    Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*.

    Drupal Swift Mailer (abandoned) drupal/swiftmailer Packagist
  • Critical 9.1
    CVE-2024-13241

    Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005

    Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.0.5.

    Drupal Open Social
  • Critical 9.8
    CVE-2024-13239

    Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003

    Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Critical 9.1
    CVE-2025-21628

    Chatwoot has a Blind SQL-injection in Conversation and Contacts filters

    Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of query_operator passed from the frontend or the API. This provided any actor who is authenticated, an attack vector to run arbitr…

    chatwoot chatwoot
  • Critical 10.0
    CVE-2025-22504

    WordPress 4ECPS Web Forms Plugin <= 0.2.18 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in jumpdemand 4ECPS Web Forms 4ecps-webforms allows Upload a Web Shell to a Web Server.This issue affects 4ECPS Web Forms: from n/a through <= 0.2.18.

    jumpdemand 4ECPS Web Forms
  • Critical 9.3
    CVE-2025-22540

    WordPress Emailing Subscription Plugin <= 1.4.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in seballero Emailing Subscription email-suscripcion allows Blind SQL Injection.This issue affects Emailing Subscription: from n/a through <= 1.4.1.

    seballero Emailing Subscription
  • Critical 9.3
    CVE-2025-22542

    WordPress Virtual Bot Plugin <= 1.0.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ofek Nakar Virtual Bot virtual-bot allows Blind SQL Injection.This issue affects Virtual Bot: from n/a through <= 1.0.0.

    Ofek Nakar Virtual Bot
  • Critical 9.8
    CVE-2024-11642

    Post Grid Master <= 3.4.12 - Missing Authorization to Unauthenticated Local PHP File Inclusion

    The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.4.12 via the 'loca…

    mdshuvo Post Grid Master — Post Grids & AJAX Filters Web / CMS
  • Critical 9.1
    CVE-2024-12802

    SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal…

    SonicWall SonicOS Network devices
  • Critical 9.3
    CVE-2024-43651

    Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC models before version 241207101 Likelihood: Moderate – The <redacted> binary doe…

    Iocharger Iocharger firmware for AC models
  • Critical 9.3
    CVE-2024-43654

    Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Injection as root This issue affects all Iocharger AC EV charger models on a firmware version before 250108…

    Iocharger Iocharger firmware for AC models
  • Critical 9.3
    CVE-2024-43649

    Authenticated command injection via <redacted>.exe <redacted> parameter

    Authenticated command injection in the filename of a <redacted>.exe request leads to remote code execution as the root user. This issue affects Iocharger firmware for AC models before version 24120701. Likelihood: Moderate – This action is not a common place …

    Iocharger Iocharger firmware for AC models
  • Critical 9.3
    CVE-2024-43653

    Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability  allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701. Likelihood: Moderate – The <redacted> b…

    Iocharger Iocharger firmware for AC models
  • Critical 9.3
    CVE-2024-43648

    Authenticated command injection via <redacted>.exe <redacted> parameter

    Command injection in the <redacted> parameter of a <redacted>.exe request leads to remote code execution as the root user. This issue affects Iocharger firmware for AC models before version 24120701. Likelihood: Moderate – This action is not a common place fo…

    Iocharger Iocharger firmware for AC models
  • Critical 9.3
    CVE-2024-43657

    When uploading new firmware, a shell script inside a firmware file is executed during its processing. This can be used to craft a custom firmware file with a custom script with arbitrary code, which will then be executed on the charging station.

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701. Likelihood: High. However, the attacker …

    Iocharger Iocharger firmware for AC models
  • Critical 9.3
    CVE-2024-43652

    Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701 Likelihood: Moderate – The <redacted> bin…

    Iocharger Iocharger firmware for AC chargers
  • Critical 9.3
    CVE-2024-43650

    Authenticated command injection in the <redacted> action leads to full remote code execution as root on the charging station

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Injection as root This issue affects  firmware versions before 24120701. Likelihood: Moderate – The <redact…

    Iocharger Iocharger firmware for AC models
  • Critical 9.3
    CVE-2024-43656

    A backup can be manipulated and then restored to create arbitrary files inside the <redacted> directory. A CGI script can be added to the web directory this way, allowing for full remote code execution.

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701. Likelihood: Moderate – It might be diffi…

    Iocharger Iocharger firmware for AC models
  • Critical 9.3
    CVE-2024-43655

    Any authenticated users can execute OS commands as root using the <redacted>.sh CGI script.

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701. Likelihood: Moderate – The attacker will…

    Iocharger Iocharger firmware for AC models
  • Critical 9.8
    CVE-2024-40765

    An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions…

    SonicWall SonicOS Network devices
  • Critical 9.8
    CVE-2024-40762

    Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generato…

    SonicWall SonicOS Network devices
  • Critical 9.8
    CVE-2023-28354 Public exploit

    An issue was discovered in Opsview Monitor Agent 6.8. An unauthenticated remote attacker can call check_nrpe against af…

  • Critical 9.8
    CVE-2024-55225

    Vaultwarden vulnerable to user impersonation

    An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.

    vaultwarden crates.io
  • Critical 9.6
    CVE-2024-55224

    Vaultwarden HTML injection vulnerability

    An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.

    vaultwarden crates.io
  • Critical 9.1
    CVE-2024-46505

    Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.

  • Critical 9.8
    CVE-2024-54724

    PHPYun before 7.0.2 is vulnerable to code execution through backdoor-restricted arbitrary file writing and file inclusi…