Skip to content
OpenAdvisories

Archive

30 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /30 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

90 results · Clear filters · Feed

  • Medium 5.9
    CVE-2024-10309

    Tracking Code Manager < 2.4.0 - Contributor+ Stored XSS

    The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.

    Web / CMS
  • Medium 6.4
    CVE-2024-12921

    EthereumICO <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ethereum-ico Shortcode

    The EthereumICO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ethereum-ico shortcode in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This …

    ethereumicoio EthereumICO Web / CMS
  • Medium 4.9
    CVE-2025-0662

    Uninitialized kernel memory disclosure via ktrace(2)

    In some cases, the ktrace facility will log the contents of kernel structures to userspace. In one such case, ktrace dumps a variable-sized sockaddr to userspace. There, the full sockaddr is copied, even when it is shorter than the full size. This can result …

    FreeBSD FreeBSD
  • Medium 6.5
    CVE-2025-0374

    Unprivileged access to system files

    When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts. This version does not preserve the mode of the input file, and is world-readable. This applies to files that would normally…

    FreeBSD FreeBSD
  • Medium 6.0
    CVE-2025-0373

    Buffer overflow in some filesystems via NFS

    On 64-bit systems, the implementation of VOP_VPTOFH() in the cd9660, tarfs and ext2fs filesystems overflows the destination FID buffer by 4 bytes, a stack buffer overflow. A NFS server that exports a cd9660, tarfs, or ext2fs file system can be made to panic b…

    FreeBSD FreeBSD
  • Medium 6.3
    CVE-2025-0849

    CampCodes School Management Software Staff edit-staff improper authorization

    A vulnerability classified as critical has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /edit-staff/ of the component Staff Handler. The manipulation leads to improper authorization. It is possible to lau…

    Campcodes School Management Software
  • Medium 6.5
    CVE-2025-0848

    Tenda A18 HTTP POST Request SetCmdlineRun stack-based overflow

    A vulnerability was found in Tenda A18 up to 15.13.07.09. It has been rated as critical. This issue affects the function SetCmdlineRun of the file /goform/SetCmdlineRun of the component HTTP POST Request Handler. The manipulation of the argument wpapsk_crypto…

    Tenda A18
  • Medium 5.7
    CVE-2024-55415 Scanner template EPSS 18%

    DevDojo Voyager vulnerable to path traversal

    DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass.

    tcg/voyager Packagist
  • Medium 4.3
    CVE-2024-55417 Scanner template EPSS 16%

    DevDojo Voyager Arbitrary File Write

    DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server.

    tcg/voyager Packagist
  • Medium 6.5
    CVE-2024-53615 Public exploit

    files.photo.gallery command injection

    A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file.

    files.photo.gallery npm