Week 1, 2025

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-11972 Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
  EPSS 59%
• Critical 9.9
  CVE-2024-12828 Webmin CGI Command Injection Remote Code Execution Vulnerability

  Webmin · Webmin

  EPSS 33%
• Critical 10.0
  CVE-2024-56064 WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability

  azzaroco · WP SuperBackup

  EPSS 33%
• Critical 9.4
  CVE-2024-12106 WhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authentication

  Progress Software · WhatsUp Gold

  EPSS 9.5%
• Critical 9.6
  CVE-2024-12108 WhatsUp Gold - Public API signing key rotation issue

  Progress Software · WhatsUp Gold

  EPSS 7.7%
• Critical 10.0
  CVE-2024-56829 Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the UploadFile element…
  EPSS 2.1%
• Critical 9.8
  CVE-2024-9140 Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulnerability allows OS …

  Moxa · EDR-G9010 Series · TN-4900 Series · NAT-102 Series

  EPSS 1.8%
• Critical 9.8
  CVE-2024-47919 Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  Tiki Wiki · CMS

  EPSS 1.6%
• Critical 9.9
  CVE-2024-12583 Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection

  alexacrm · Dynamics 365 Integration

  EPSS 1.4%
• Critical 9.8
  CVE-2024-13061 2100 Technology Electronic Official Document Management System - Authentication Bypass

  2100 Technology Electronic · Official Document Management System

  EPSS 1.3%
• Critical 9.1
  CVE-2024-56249 WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Upload vulnerability

  Ludwig You · WPMasterToolKit

  EPSS 1.3%
• Critical 9.8
  CVE-2024-56044 WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability

  VibeThemes · WPLMS

• Critical 9.8
  CVE-2024-56040 WordPress VibeBP plugin <= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability

  VibeThemes · VibeBP

• Critical 10.0
  CVE-2024-56046 WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability

  VibeThemes · WPLMS

• Critical 9.3
  CVE-2024-56198 path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability

  cabraviva · path-sanitizer

All 31 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 6.5
  CVE-2024-12105 WhatsUp Gold - SnmpExtendedActiveMonitor path traversal

  Progress Software · WhatsUp Gold

  EPSS 42%
• Medium 5.3
  CVE-2024-13106 D-Link DIR-816 A2 IP QoS form2IPQoSTcAdd access control

  D-Link · DIR-816 A2

  EPSS 26%
• High 8.8
  CVE-2024-13129 Roxy-WI roxy.py action_service os command injection
  EPSS 18%
• High 7.5
  CVE-2024-56067 WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerability

  azzaroco · WP SuperBackup

  EPSS 12%
• Medium 5.3
  CVE-2024-11716 While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticate…

  CTFd · CTFd

  EPSS 12%
• High 7.3
  CVE-2024-13030 D-Link DIR-823G Web Management Interface HNAP1 SetVirtualServerSettings access control

  D-Link · DIR-823G

  EPSS 2%
• High 7.5
  CVE-2024-11944 iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability

  iXsystems · TrueNAS CORE

  EPSS 1.6%
• Medium 4.3
  CVE-2025-22214 Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.
  EPSS 1.3%