Archive
January 2025
Vulnerabilities first published in this month (UTC), newest first.
60 results · Clear filters · Feed
-
High 7.5CVE-2024-53582 Public exploit
An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to exe…
-
High 7.5CVE-2024-23733 Public exploit
The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Cor…
-
High 7.7CVE-2024-40676 Public exploit
In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an…
-
High 8.8CVE-2024-55968 Public exploit
An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handl…
-
High 8.8CVE-2024-57376 Public exploit
Buffer Overflow vulnerability in D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500N, DSR-1000N from 3.13 to 3.17B901…
-
High 8.7
Cacti allows Arbitrary File Creation leading to RCE
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on t…
-
High 8.1CVE-2024-57373 Public exploit
Cross Site Request Forgery (CSRF) vulnerability in LifestyleStore v1.0 allows a remote attacker to execute unauthorized…
-
High 7.0
7-Zip Mark-of-the-Web Bypass Vulnerability
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must vi…
KEV Feb 6, 2025 -
High 7.6
WordPress Email Subscription Popup plugin <= 1.2.23 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nks Email Subscription Popup email-subscribe allows Blind SQL Injection.This issue affects Email Subscription Popup: from n/a through <= 1.2.23.
-
High 7.6CVE-2025-24659 Public exploit
WordPress Premium Packages – Sell Digital Products Securely plugin <= 5.9.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Blind SQL Injection.This issue affects WPDM – Premium Packages: from n/a through <= 5.9.6.
-
High 8.8CVE-2024-31903 Public exploit
IBM Sterling B2B Integrator Standard Edition code execution
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 allow an attacker on the local network to execute arbitrary code on the system, caused by the deserialization of untrusted data.
-
High 7.3CVE-2024-56924 Public exploit
A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers t…
-
High 7.6CVE-2025-23369 Public exploit
Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an e…
-
High 7.1CVE-2025-24001 Public exploit
WordPress PPO Call To Actions plugin <= 0.1.3 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PPO Call To Actions: from n/a through <= 0.1.3.
-
High 7.6CVE-2025-22710 Public exploit
WordPress Smart Manager Plugin <= 8.52.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce allows Blind SQL Injection.This issue affects Smart Manager: from n/a through <= 8.52.0.
-
High 8.8CVE-2024-49699 Public exploit
WordPress ARPrice plugin <= 4.1.3 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
-
High 7.5CVE-2024-24451 Public exploit
A stack overflow in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v…
-
High 7.5CVE-2024-13184 Public exploit
The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions up to, and including, 3.0.12 due to insufficient escaping on the user supplied parameter and lack of …
-
High 7.8CVE-2018-9375 Public exploit
In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dicti…
-
High 7.8CVE-2024-55511 Public exploit
A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system…
-
High 7.5CVE-2024-52005 Public exploit
The sideband payload is passed unfiltered to the terminal in git
Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "r…
-
High 8.1CVE-2024-11848 Public exploit
NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_forever' AJAX action in all versions up to, and including, 1.17.0. This makes it possible for authenticate…
-
High 8.1CVE-2025-22964 Public exploit
DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability cause…
-
High 7.8
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
KEV Jan 14, 2025 -
High 8.8
Active Directory Domain Services Elevation of Privilege Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
-
High 7.5CVE-2024-12085 Public exploit
Rsync: info leak via uninitialized stack contents
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitializ…
-
High 8.2CVE-2024-7344 Public exploit
Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.
Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.
-
High 8.5CVE-2024-12365 Public exploit
W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Sub…
-
High 8.8CVE-2024-50858 Public exploit
Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute acti…
-
High 7.5CVE-2025-22963 Public exploit
Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.
-
High 7.5CVE-2024-12404 Public exploit
CF Internal Link Shortcode <= 1.1.0 - Unauthenticated SQL Injection
The CF Internal Link Shortcode plugin for WordPress is vulnerable to SQL Injection via the 'post_title' parameter in all versions up to, and including, 1.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…
-
High 8.8
Microsoft Purview Information Disclosure Vulnerability
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.
-
High 7.2CVE-2025-22510 Public exploit
WordPress WC Price History for Omnibus plugin <= 2.1.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in kkarpieszuk WC Price History for Omnibus wc-price-history allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through <= 2.1.4.
-
High 8.2CVE-2023-24012 Public exploit
Data Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Open DDS
An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure DDS databus system by exploiting vulnerable attributes in the configuration of PKCS#7 certificate’s…
-
High 8.6CVE-2024-12542 Public exploit
linkID <= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure
The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 0.1.2. This makes it possible for unauthenticated attackers to read conf…
-
High 8.2
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass auth…
KEV Feb 18, 2025 -
High 8.0CVE-2024-54887 Public exploit
TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver…
-
High 8.8
RedisBloom Integer Overflow Remote Code Execution Vulnerability
RedisBloom adds a set of probabilistic data structures to Redis. There is an integer overflow vulnerability in RedisBloom, which is a module used in Redis. The integer overflow vulnerability allows an attacker (a redis client which knows the password) to allo…
-
High 7.5CVE-2024-11423 Public exploit
Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch
The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable …
-
High 8.8CVE-2024-51442 Public exploit
Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a speci…