Skip to content
OpenAdvisories

Archive

13 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /13 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

36 results · Clear filters · Feed

  • High 8.4
    CVE-2024-11128

    Insufficient Hardened Runtime or Library Validation signing in Bitdefender Virus Scanner for macOS

    A vulnerability in the BitdefenderVirusScanner binary as used in Bitdefender Virus Scanner for MacOS may allow .dynamic library injection (DYLD injection) without being blocked by AppleMobileFileIntegrity (AMFI). This issue is caused by the absence of Hardene…

    Bitdefender Virus Scanner
  • High 8.4
    CVE-2024-52333

    An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A sp…

    OFFIS DCMTK dcmtk dcmtk Debian Ubuntu
  • High 8.4
    CVE-2024-47796

    An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. A specially…

    OFFIS DCMTK dcmtk dcmtk Debian Ubuntu
  • High 7.1
    CVE-2024-56065

    WordPress WP2LEADS Plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.4.2.

    Saleswonder Team: Tobias WP2LEADS
  • High 7.1
    CVE-2024-56301

    WordPress Distance Based Shipping Calculator Plugin <= 2.0.21 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Reflected XSS.This issue affects Distance Based Shipping Calcu…

    Eniture technology Distance Based Shipping Calculator
  • High 7.1
    CVE-2025-22314

    WordPress Food Store plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Scripts Food Store – Online Food Delivery & Pickup food-store allows Reflected XSS.This issue affects Food Store – Online Food Delivery & Pickup: from n/a…

    WP Scripts Food Store – Online Food Delivery & Pickup
  • High 7.1
    CVE-2025-22337

    WordPress Order Audit Log for WooCommerce plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin Order Audit Log for WooCommerce order-audit-log-for-woocommerce allows Reflected XSS.This issue affects Order Audit Log for WooCommerce: from …

    infosoftplugin Order Audit Log for WooCommerce Web / CMS
  • High 7.1
    CVE-2025-22498

    WordPress LucidLMS plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N3wNormal LucidLMS lucidlms allows Reflected XSS.This issue affects LucidLMS: from n/a through <= 1.0.5.

    N3wNormal LucidLMS
  • High 7.1
    CVE-2025-22344

    WordPress Media Category Library plugin <= 2.7 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in timmcdaniels Media Category Library media-category-library allows Reflected XSS.This issue affects Media Category Library: from n/a through <= 2.7.

    timmcdaniels Media Category Library
  • High 7.1
    CVE-2025-22506

    WordPress Smart Agenda Plugin <= 4.7 - CSRF to Stored XSS vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smart Agenda Smart Agenda smart-agenda-prise-de-rendez-vous-en-ligne allows Stored XSS.This issue affects Smart Agenda: from n/a through <= 4.7.

    Smart Agenda Smart Agenda
  • High 7.1
    CVE-2025-22499

    WordPress F4 Post Tree Plugin <= 1.1.18 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FAKTOR VIER F4 Post Tree f4-tree allows Reflected XSS.This issue affects F4 Post Tree: from n/a through <= 1.1.18.

    FAKTOR VIER F4 Post Tree
  • High 7.1
    CVE-2025-22567

    WordPress TRUSTist REVIEWer Plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trustist TRUSTist REVIEWer trustist-reviewer allows Reflected XSS.This issue affects TRUSTist REVIEWer: from n/a through <= 2.0.

    trustist TRUSTist REVIEWer
  • High 7.1
    CVE-2025-22514

    WordPress Axact Author List Widget Plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yamna Khawaja KNR Author List Widget knr-author-list-widget allows Reflected XSS.This issue affects KNR Author List Widget: from n/a through <= 3.1.1.

    Yamna Khawaja KNR Author List Widget
  • High 7.1
    CVE-2025-22568

    WordPress Post And Page Reactions Plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arete-it Post And Page Reactions post-and-page-reactions allows Reflected XSS.This issue affects Post And Page Reactions: from n/a through <= 1.0.5.

    arete-it Post And Page Reactions
  • High 7.1
    CVE-2025-22569

    WordPress Featured Page Widget Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GrandSlambert Featured Page Widget featured-page-widget allows Reflected XSS.This issue affects Featured Page Widget: from n/a through <= 2.2.

    GrandSlambert Featured Page Widget
  • High 7.1
    CVE-2025-22570

    WordPress Inline Tweets plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mdjekic Inline Tweets inline-tweets allows Stored XSS.This issue affects Inline Tweets: from n/a through <= 2.0.

    mdjekic Inline Tweets
  • High 7.1
    CVE-2025-22576

    WordPress Site PIN Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Downing Site PIN site-pin allows Reflected XSS.This issue affects Site PIN: from n/a through <= 1.3.

    Marcus Downing Site PIN
  • High 7.1
    CVE-2025-22583

    WordPress Scan External Links Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anshulsojatia Scan External Links scan-external-links allows Reflected XSS.This issue affects Scan External Links: from n/a through <= 1.0.

    anshulsojatia Scan External Links
  • High 7.1
    CVE-2025-22588

    WordPress Scanventory Plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in intelligence_lab Scanventory woocommerce-inventory-management allows Reflected XSS.This issue affects Scanventory: from n/a through <= 1.1.3.

    intelligence_lab Scanventory
  • High 7.1
    CVE-2025-22586

    WordPress WPEX Replace DB Urls Plugin <= 0.4.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dstoever WPEX Replace DB Urls wpex-replace allows Reflected XSS.This issue affects WPEX Replace DB Urls: from n/a through <= 0.4.0.

    dstoever WPEX Replace DB Urls
  • High 7.8
    CVE-2024-52938

    GPU DDK - rgxfw_pm_add_freelist_for_reconstruction OOB write

    Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to subvert reconstruction activities to trigger a write of data outside the Guest's virtualised GPU memory.

    Imagination Technologies Graphics DDK
  • High 7.1
    CVE-2024-47895

    GPU DDK - OOB read into fwlog due to unchecked block count

    Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory.

    Imagination Technologies Graphics DDK
  • High 7.1
    CVE-2024-47894

    GPU DDK - Out of bounds read into fwlog due to unchecked loop bounds

    Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory.

    Imagination Technologies Graphics DDK
  • High 8.8
    CVE-2024-47897

    GPU DDK - PVRSRVRGXGetEnabledHWPerfBlocksKM off-by-one OOB write

    Software installed and run as a non-privileged user may conduct improper GPU system calls resulting in platform instability and reboots.

    Imagination Technologies Graphics DDK
  • High 7.5
    CVE-2024-12274

    BookingPress < 1.1.23 - Unauthenticated Export File Download

    The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name, allowing unauthenticated attackers to access the exported files (if…

    Web / CMS
  • High 7.8
    CVE-2025-0412

    Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability

    Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this…

    Luxion KeyShot Viewer
  • High 7.5
    CVE-2023-42232

    Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Navigator/Index functio…

  • High 7.5
    CVE-2023-42227

    Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the WSCView/Save function.

  • High 8.8
    CVE-2023-42244

    An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform S…

  • High 8.8
    CVE-2023-42228

    Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can …

  • High 7.5
    CVE-2023-42225

    Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Attachment/DownloadTemp…

  • High 7.5
    CVE-2023-42226

    Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via Email/SaveAttachment functi…

  • High 8.1
    CVE-2023-42231

    Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can …

  • High 8.4
    CVE-2024-46480

    An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator ac…

    Venki Supravizio BPM
  • High 7.2
    CVE-2024-46481

    The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS.

    Venki Supravizio BPM
  • High 7.5
    CVE-2025-22963 Public exploit

    Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.

    Sismics Teedy