Skip to content
OpenAdvisories

Archive

11 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /11 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

49 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-23109

    Address bar spoofing on iOS using long hostnames

    Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This vulnerability was fixed in Firefox for iOS 134.

    Mozilla Firefox for iOS firefox iOS Browsers Wolfi
  • Medium 4.3
    CVE-2025-23108

    Firefox Mobile iOS Full Address Bar Spoof Using Open in New Tab and Javascript URI

    Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This vulnerability was fixed in Firefox for iOS 134.

    Mozilla Firefox for iOS firefox iOS Browsers Wolfi
  • Medium 6.4
    CVE-2024-12304

    Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link

    The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via button block link in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. …

    stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Web / CMS
  • Medium 6.9
    CVE-2025-0106

    Expedition: Wildcard Expansion Vulnerability

    A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesystem.

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 6.9
    CVE-2025-0105 EPSS 13%

    Expedition: Arbitrary File Deletion Vulnerability

    An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host filesystem.

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 5.4
    CVE-2024-12204

    Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization

    The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in the class-cx-rest.php file in all versions up to, and…

    Premio Coupon X – Discount Popups & Promo Codes Pop Ups for WooCommerce Web / CMS
  • Medium 6.1
    CVE-2024-11327

    ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Reflected Cross-Site Scripting

    The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in…

    ClickWhale ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages Web / CMS
  • Medium 6.4
    CVE-2024-12505

    Trackserver <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Trackserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tsmap' shortcode in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

    tinuzz Trackserver Web / CMS
  • Medium 4.3
    CVE-2024-12472

    Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure

    The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This makes it possible for aut…

    Metaphor Creations Post Duplicator Web / CMS