Skip to content
OpenAdvisories

Archive

16 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /16 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

21 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-23922 Public exploit

    WordPress iSpring Embedder plugin <= 1.0 - CSRF to Arbitrary File Upload vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder embed-ispring allows Upload a Web Shell to a Web Server.This issue affects iSpring Embedder: from n/a through <= 1.0.

    Harsh iSpring Embedder
  • Critical 9.8
    CVE-2025-23797

    WordPress WP Options Editor plugin <= 1.1 - CSRF to Privilege Escalation vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Mike Selander WP Options Editor wp-options-editor allows Privilege Escalation.This issue affects WP Options Editor: from n/a through <= 1.1.

    Mike Selander WP Options Editor
  • Critical 9.9
    CVE-2025-0471

    Unrestricted Upload of File with Dangerous Type vulnerability in PMB platform

    Unrestricted file upload vulnerability in the PMB platform, affecting versions 4.0.10 and above. This vulnerability could allow an attacker to upload a file to gain remote access to the machine, being able to access, modify and execute commands freely.

    PMB Services PMB platform
  • Critical 9.8
    CVE-2025-0456

    NetVision Information airPASS - Missing Authentication

    The airPASS from NetVision Information has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access the specific administrative functionality to retrieve * all accounts and passwords.

    NetVision Information airPASS
  • Critical 9.8
    CVE-2025-0455

    NetVision Information airPASS - SQL injection

    The airPASS from NetVision Information has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

    NetVision Information airPASS
  • Critical 9.1
    CVE-2024-53553

    An issue in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 allows attackers to bypass authentication via crafted web requ…

  • Critical 9.8
    CVE-2024-57581

    Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallC…

  • Critical 9.8
    CVE-2024-57575

    Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi…

  • Critical 9.8
    CVE-2024-57684 EPSS 15%

    An access control issue in the component formDMZ.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated a…

  • Critical 9.8
    CVE-2024-57583

    Tenda AC18 V15.03.05.19 was discovered to contain a command injection vulnerability via the usbName parameter in the fo…

  • Critical 9.8
    CVE-2024-57582

    Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the startIP parameter in the formSetPPTPServer f…

  • Critical 9.8
    CVE-2024-57768

    JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysR…

  • Critical 9.8
    CVE-2024-57580

    Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName f…

  • Critical 9.8
    CVE-2024-57579

    Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the limitSpeedUp parameter in the formSetClientS…

  • Critical 9.8
    CVE-2025-22906

    RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWA…

  • Critical 9.8
    CVE-2025-22912 Public exploit

    RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept.

  • Critical 9.8
    CVE-2025-22913

    RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formStaDrvSetup function.

  • Critical 9.8
    CVE-2025-22904

    RE11S v1.11 was discovered to contain a stack overflow via the pptpUserName parameter in the setWAN function.

  • Critical 9.8
    CVE-2025-22916

    RE11S v1.11 was discovered to contain a stack overflow via the pppUserName parameter in the formPPPoESetup function.

  • Critical 9.8
    CVE-2025-22905

    RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp.

  • Critical 9.8
    CVE-2025-22907

    RE11S v1.11 was discovered to contain a stack overflow via the selSSID parameter in the formWlSiteSurvey function.