Skip to content
OpenAdvisories

Archive

January 2025

Vulnerabilities first published in this month (UTC), newest first.

← December 2024 2025 / January February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

2,209 results · Clear filters · Feed

  • Medium 4.7
    CVE-2024-12595

    AHAthat Plugin <= 1.6 - Reflected XSS via REQUEST_URI

    The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

    Web / CMS
  • Medium 5.9
    CVE-2024-11357

    Goodlayers Core < 2.0.10 - Contributor+ Stored XSS

    The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

    Web / CMS
  • Medium 4.8
    CVE-2024-11184

    WP Enabled SVG <= 0.7 - Author+ Stored XSS via SVG

    The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts

    mwdelaney/wp-enable-svg Web / CMS Packagist
  • Medium 4.7
    CVE-2024-48197 Public exploit

    Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via th…

  • Medium 5.4
    CVE-2024-56830

    The Net::EasyTCP package 0.15 through 0.26 for Perl uses Perl's builtin rand() if no strong randomization module is pre…

    libnet-easytcp-perl libnet-easytcp-perl Debian Ubuntu
  • Medium 5.4
    CVE-2002-20002

    The Net::EasyTCP package before 0.15 for Perl always uses Perl's builtin rand(), which is not a strong random number ge…

  • Medium 4.3
    CVE-2025-22214 Scanner template

    Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.

  • Medium 6.3
    CVE-2025-0168

    code-projects Job Recruitment _feedback_system.php sql injection

    A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /_parse/_feedback_system.php. The manipulation of the argument person leads to sql injection. It is possible to initiate the a…

    code-projects Job Recruitment
  • Medium 6.1
    CVE-2024-11846

    Travel Tour < 5.2.4 - Reflected XSS

    The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin