Skip to content
OpenAdvisories

Archive

January 2025

Vulnerabilities first published in this month (UTC), newest first.

← December 2024 2025 / January February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

2,209 results · Clear filters · Feed

  • Medium 5.4
    CVE-2024-13273

    Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Open Social allows Cross-Site Scripting (XSS).This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5, from 13.0.0 before …

    Drupal Open Social
  • Medium 6.3
    CVE-2024-13272

    Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036

    Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.

    Drupal Paragraphs table drupal/paragraphs_table Packagist
  • Medium 4.3
    CVE-2024-13271

    Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035

    Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.

    Drupal Content Entity Clone drupal/content_entity_clone Packagist
  • Medium 4.3
    CVE-2024-13270

    Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034

    Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1.

    Drupal Freelinking drupal/freelinking Packagist
  • Medium 5.3
    CVE-2024-13269

    Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.

    Drupal Advanced Varnish drupal/adv_varnish Packagist
  • Medium 6.8
    CVE-2024-13268

    Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23.

    Drupal Opigno
  • Medium 5.3
    CVE-2024-13266

    Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030

    Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4.

    Drupal Responsive and off-canvas menu drupal/responsive_menu Packagist
  • Medium 5.5
    CVE-2024-13263

    Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1.

    Drupal Opigno group manager drupal/opigno_group_manager Packagist
  • Medium 4.8
    CVE-2024-13262

    View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal View Password allows Cross-Site Scripting (XSS).This issue affects View Password: from 0.0.0 before 6.0.4.

    Drupal View Password drupal/view_password Packagist
  • Medium 5.3
    CVE-2024-13257

    Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021

    Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.

    Drupal Commerce View Receipt drupal/commerce_view_receipt Packagist
  • Medium 5.4
    CVE-2024-13252

    TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal TacJS allows Cross-Site Scripting (XSS).This issue affects TacJS: from 0.0.0 before 6.5.0.

    Drupal TacJS drupal/tacjs Packagist
  • Medium 5.4
    CVE-2024-13249

    Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013

    Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2.

    Drupal Node Access Rebuild Progressive
  • Medium 5.5
    CVE-2024-13248

    Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012

    Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.

    Drupal Private content drupal/private_content Packagist
  • Medium 4.8
    CVE-2024-13247

    Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Coffee allows Cross-Site Scripting (XSS).This issue affects Coffee: from 0.0.0 before 1.4.0.

    Drupal Coffee drupal/coffee Packagist
  • Medium 5.3
    CVE-2024-13246

    Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010

    Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.

    Drupal Node Access Rebuild Progressive drupal/node_access_rebuild_progressive Packagist
  • Medium 5.4
    CVE-2024-13245

    CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.…

    Drupal CKEditor 4 LTS - WYSIWYG HTML editor drupal/ckeditor_lts Packagist
  • Medium 6.5
    CVE-2024-13243

    Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

    Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1.

    Drupal Entity Delete Log drupal/entity_delete_log Packagist
  • Medium 5.4
    CVE-2024-13238

    Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Typogrify allows Cross-Site Scripting (XSS).This issue affects Typogrify: from 0.0.0 before 1.3.0.

    Drupal Typogrify py3.10-typogrify py3.12-typogrify Wolfi Packagist
  • Medium 5.4
    CVE-2024-13237

    File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal File Entity (fieldable files) allows Cross-Site Scripting (XSS).This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.38.

    Drupal File Entity (fieldable files)
  • Medium 6.5
    CVE-2025-21600

    Junos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crash

    An Out-of-Bounds Read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, re…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2025-21602

    Junos OS and Junos OS Evolved: Receipt of specially crafted BGP update packet causes RPD crash

    An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a specific BGP update packet to cause rpd to crash and rest…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 5.5
    CVE-2025-21596

    Junos OS: SRX1500,SRX4100,SRX4200: Execution of low-privileged CLI command results in chassisd crash

    An Improper Handling of Exceptional Conditions vulnerability in the command-line processing of Juniper Networks Junos OS on SRX1500, SRX4100, and SRX4200 devices allows a local, low-privileged authenticated attacker executing the 'show chassis environment pem…

    Juniper Networks Junos OS Network devices
  • Medium 6.5
    CVE-2025-21593

    Junos OS and Junos OS Evolved: On SRv6 enabled devices, an attacker sending a malformed BGP update can cause the rpd to crash

    An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS). On devices with SR…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 5.5
    CVE-2025-21592

    Junos OS: SRX Series: Low privileged user able to access highly sensitive information on file system

    An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of sensiti…

    Juniper Networks Junos OS Network devices
  • Medium 4.3
    CVE-2025-22561

    WordPress Title Experiments Free plugin <= 9.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in kbowson Title Experiments Free wp-experiments-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Title Experiments Free: from n/a through <= 9.0.4.

    kbowson Title Experiments Free
  • Medium 6.5
    CVE-2025-22801

    WordPress Free WooCommerce Theme 99fy Extension plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes Free WooCommerce Theme 99fy Extension 99fy-core allows Stored XSS.This issue affects Free WooCommerce Theme 99fy Extension: from n/a through <= 1.2…

    HasThemes Free WooCommerce Theme 99fy Extension Web / CMS
  • Medium 6.5
    CVE-2025-22802

    WordPress Email Templates Customizer YeeMail plugin <= 2.1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail yeemail allows Stored XSS.This issue affects Email Tem…

    add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail Web / CMS
  • Medium 6.5
    CVE-2025-22803

    WordPress Advanced Product Information for WooCommerce plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Advanced Product Information for WooCommerce woo-advanced-product-information allows Stored XSS.This issue affects Advanced Product Information fo…

    villatheme Advanced Product Information for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-22804

    WordPress Author Avatars List/Block plugin <= 2.1.23 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through <= 2.1.23.

    Paul Bearne Author Avatars List/Block
  • Medium 6.5
    CVE-2025-22805

    WordPress Skill Bar Plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Skill Bar skillbars allows Stored XSS.This issue affects Skill Bar: from n/a through <= 1.2.

    Themepoints Skill Bar
  • Medium 6.5
    CVE-2025-22806

    WordPress Black Widgets For Elementor plugin <= 1.3.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor black-widgets allows DOM-Based XSS.This issue affects Black Widgets For Elementor: from n/a through <= 1.3.8.

    Modernaweb Studio Black Widgets For Elementor
  • Medium 6.5
    CVE-2025-22807

    WordPress Responsive Flickr Slideshow Plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Responsive Flickr Slideshow mobile-friendly-flickr-slideshow allows Stored XSS.This issue affects Responsive Flickr Slideshow: from n/a through <= 2.6…

    Robert Responsive Flickr Slideshow
  • Medium 6.5
    CVE-2025-22808

    WordPress Surbma | Premium WP plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Surbma Surbma | Premium WP surbma-premium-wp allows DOM-Based XSS.This issue affects Surbma | Premium WP: from n/a through <= 9.0.

    Surbma Surbma | Premium WP
  • Medium 6.5
    CVE-2025-22809

    WordPress PDF Catalog Woocommerce plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theme funda PDF Catalog Woocommerce pdf-catalog-woocommerce allows DOM-Based XSS.This issue affects PDF Catalog Woocommerce: from n/a through <= 2.0.

    theme funda PDF Catalog Woocommerce Web / CMS
  • Medium 6.5
    CVE-2025-22810

    WordPress Content Blocks Builder plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phi Phan Content Blocks Builder content-blocks-builder allows Stored XSS.This issue affects Content Blocks Builder: from n/a through <= 2.7.6.

    Phi Phan Content Blocks Builder
  • Medium 6.5
    CVE-2025-22811

    WordPress MT Addons for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristian Stan MT Addons for Elementor mt-addons-for-elementor allows Stored XSS.This issue affects MT Addons for Elementor: from n/a through <= 1.0.6.

    Cristian Stan MT Addons for Elementor
  • Medium 6.5
    CVE-2025-22812

    WordPress News Ticker Widget for Elementor plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aezaz Shaikh News Ticker Widget for Elementor news-ticker-widget-for-elementor allows Stored XSS.This issue affects News Ticker Widget for Elementor: from n/…

    Aezaz Shaikh News Ticker Widget for Elementor
  • Medium 6.5
    CVE-2025-22813

    WordPress ChatBot Conversational Forms plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through <=…

    Quantum Cloud Conversational Forms for ChatBot
  • Medium 6.5
    CVE-2025-22815

    WordPress Button Block plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through <= 1.1.9.

    bPlugins Button Block
  • Medium 6.5
    CVE-2025-22818

    WordPress S3Player plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S3Bubble S3Player – WooCommerce & Elementor Integration drm-protected-video-streaming allows Stored XSS.This issue affects S3Player – WooCommerce & Elementor…

    S3Bubble S3Player – WooCommerce & Elementor Integration Web / CMS