Skip to content
OpenAdvisories

Archive

21 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /21 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.6
    CVE-2025-23369 Public exploit

    Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation

    An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an e…

    GitHub Enterprise Server
  • Medium 5.3
    CVE-2025-24011 Public exploit

    Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes

    Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management …

    umbraco Umbraco-CMS Umbraco.Cms NuGet
  • High 7.1
    CVE-2025-24001 Public exploit

    WordPress PPO Call To Actions plugin <= 0.1.3 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PPO Call To Actions: from n/a through <= 0.1.3.

    Ngô Thắng IT PPO Call To Actions
  • High 7.6
    CVE-2025-22710 Public exploit

    WordPress Smart Manager Plugin <= 8.52.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce allows Blind SQL Injection.This issue affects Smart Manager: from n/a through <= 8.52.0.

    StoreApps Smart Manager
  • Critical 9.3
    CVE-2024-51818 Public exploit EPSS 16%

    WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designer: from n/a through <= 6.4.3.

    radykal Fancy Product Designer
  • High 8.8
    CVE-2024-49699 Public exploit

    WordPress ARPrice plugin <= 4.1.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.

    Repute InfoSystems ARPrice
  • Medium 5.5
    CVE-2024-55504 Public exploit

    An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially…

  • High 7.5
    CVE-2024-24451 Public exploit

    A stack overflow in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v…

  • Medium 5.4
    CVE-2024-48392 Public exploit

    OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into …