Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2025

219 records · 17 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 3

  • CVE-2025-22214
    17Monitor

    Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.

    MediumCVSS 4.3Proof of conceptEPSS 1%

    Jan 2, 2025

  • CVE-2024-12912
    28Monitor

    An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution.

    HighCVSS 7.2Proof of conceptEPSS 1%

    asus · routerJan 2, 2025

  • CVE-2023-45828
    21Monitor

    WordPress RumbleTalk Live Group Chat plugin <= 6.2.5 - Broken Access Control vulnerability

    MediumCVSS 5.4Proof of conceptEPSS 0%

    rumbletalk · rumbletalk live group chatJan 2, 2025

  • CVE-2023-47179
    35Monitor

    WordPress WooODT Lite plugin <= 2.4.6 - Arbitrary Site Option Update vulnerability

    HighCVSS 8.8Proof of conceptEPSS 0%

    byconsole · wooodt liteJan 2, 2025

  • CVE-2024-13106
    35Monitor

    D-Link DIR-816 A2 IP QoS form2IPQoSTcAdd access control

    MediumCVSS 6.9No exploitEPSS 26%

    dlink · dir-816 firmwareJan 2, 2025

  • CVE-2024-56249
    36Monitor

    WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    ludwig you · wpmastertoolkitJan 2, 2025

  • CVE-2024-56264
    26Monitor

    WordPress ACF City Selector plugin <= 1.14.0 - Arbitrary File Upload vulnerability

    MediumCVSS 6.6Proof of conceptEPSS 0%

    beee · acf city selectorJan 2, 2025

  • CVE-2024-9950
    34Monitor

    Abuse of Unauthenticated Compliance Recheck in SecureConnector

    HighCVSS 8.5Proof of conceptEPSS 0%

    forescout · secureconnectorJan 2, 2025

  • CVE-2024-11716
    24Monitor

    While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation al

    MediumCVSS 5.3No exploitEPSS 11%

    ctfd · ctfdJan 2, 2025

  • CVE-2024-48197
    18Monitor

    Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via the login page of the w

    MediumCVSS 4.7Proof of conceptEPSS 0%

    Jan 2, 2025

  • CVE-2024-13129
    39Monitor

    Roxy-WI roxy.py action_service os command injection

    HighCVSS 8.7No exploitEPSS 17%

    Jan 3, 2025

  • CVE-2024-12583
    39Monitor

    Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection

    CriticalCVSS 9.9Proof of conceptEPSS 1%

    alexacrm · dynamics 365 integrationJan 4, 2025

  • CVE-2024-20154
    36Monitor

    In Modem, there is a possible out of bounds write due to a missing bounds check.

    HighCVSS 8.8Proof of conceptEPSS 3%

    mediatek · lr12aJan 6, 2025

  • CVE-2024-12970
    15Monitor

    OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer

    LowCVSS 3.9Proof of conceptEPSS 1%

    tubitak bilgem · pardus os my computerJan 6, 2025

  • CVE-2024-54879
    36Monitor

    SeaCMS V13.1 is vulnerable to Incorrect Access Control.

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    seacms · seacmsJan 6, 2025

  • CVE-2024-54880
    36Monitor

    SeaCMS V13.1 is vulnerable to Incorrect Access Control.

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    seacms · seacmsJan 6, 2025

  • CVE-2024-46209
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitr

    MediumCVSS 5.4Proof of conceptEPSS 0%

    redaxo · redaxoJan 6, 2025

  • CVE-2021-27285
    33Monitor

    An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execute arbitrary commands

    HighCVSS 8.4Proof of conceptEPSS 0%

    inspur · clusterengineJan 6, 2025

  • CVE-2024-46981
    41Plan

    Redis' Lua library commands may lead to remote code execution

    CriticalCVSS 9.8Proof of conceptEPSS 8%

    redis · redisJan 6, 2025

  • CVE-2024-48455
    12Monitor

    An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0

    LowCVSS 2.7WeaponizedEPSS 6%

    Jan 6, 2025

  • CVE-2024-48456
    35Monitor

    An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0

    HighCVSS 7.5WeaponizedEPSS 16%

    Jan 6, 2025

  • CVE-2024-48457
    31Monitor

    An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0

    HighCVSS 7.5WeaponizedEPSS 3%

    Jan 6, 2025

  • CVE-2024-54763
    26Monitor

    An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information witho

    MediumCVSS 6.5Proof of conceptEPSS 0%

    Jan 6, 2025

  • CVE-2024-54764
    26Monitor

    An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information with

    MediumCVSS 6.5Proof of conceptEPSS 1%

    Jan 6, 2025

  • CVE-2024-54767
    31Monitor

    An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information w

    HighCVSS 7.5Proof of conceptEPSS 1%

    Jan 6, 2025

  • CVE-2024-12157
    30Monitor

    Popup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Unauthenticated SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 1%

    arrowplugins · popup – mailchimp, getresponse and activecampaign intergrationsJan 7, 2025

  • CVE-2024-12252
    40Plan

    SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    seobeginner · seo lat auto postJan 7, 2025

  • CVE-2024-12471
    35Monitor

    Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arb

    HighCVSS 8.8Proof of conceptEPSS 1%

    postsaint · post saint: chatgpt, gpt4, dall-e, stable diffusion, pexels, dezgo ai text & image generatorJan 7, 2025

  • CVE-2024-12535
    34Monitor

    Host PHP Info <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure

    HighCVSS 8.6Proof of conceptEPSS 0%

    eflyjason · host php infoJan 7, 2025

  • CVE-2024-12849
    44Plan

    Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read

    HighCVSS 7.5Proof of conceptEPSS 48%

    wpguruin · error log viewer by wp guruJan 7, 2025

  • CVE-2024-56278
    37Monitor

    WordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    smackcoders inc., · wp ultimate exporterJan 7, 2025

  • CVE-2024-56289
    28Monitor

    WordPress Groundhogg plugin <= 3.7.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1Proof of conceptEPSS 0%

    adrian tobey · groundhoggJan 7, 2025

  • CVE-2025-22352
    30Monitor

    WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin <= 1.4.9 - SQL Injection vulnerability

    HighCVSS 7.6Proof of conceptEPSS 0%

    elextensions · elex woocommerce advanced bulk edit products, prices & attributesJan 7, 2025

  • CVE-2024-48245
    28Monitor

    Vehicle Management System 1.0 is vulnerable to SQL Injection.

    HighCVSS 7.2Proof of conceptEPSS 1%

    janobe · vehicle management systemJan 7, 2025

  • CVE-2024-53345
    35Monitor

    An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code

    HighCVSS 8.8Proof of conceptEPSS 1%

    Jan 7, 2025

  • CVE-2024-55556
    52Plan

    A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on th

    CriticalCVSS 9.8WeaponizedEPSS 43%

    Jan 7, 2025

  • CVE-2025-22294
    28Monitor

    WordPress Custom Field For WP Job Manager plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1Proof of conceptEPSS 0%

    theme funda · custom field for wp job managerJan 7, 2025

  • CVE-2024-55555
    37Monitor

    Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY.

    HighCVSS 8.8WeaponizedEPSS 6%

    Jan 7, 2025

  • CVE-2024-44450
    21Monitor

    Multiple functions are vulnerable to Authorization Bypass in AIMS eCrew.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    Jan 7, 2025

  • CVE-2024-53522
    30Monitor

    Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI co

    HighCVSS 7.5Proof of conceptEPSS 0%

    Jan 7, 2025

  • CVE-2024-54819
    42Plan

    I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/sec

    CriticalCVSS 9.1Proof of conceptEPSS 20%

    Jan 7, 2025

  • CVE-2024-55218
    24Monitor

    IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    icewarp · icewarpJan 7, 2025

  • CVE-2025-0242
    30Monitor

    Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6

    MediumCVSS 6.5No exploitEPSS 14%

    mozilla · firefoxJan 7, 2025

  • CVE-2025-0247
    42Plan

    Memory safety bugs fixed in Firefox 134 and Thunderbird 134

    CriticalCVSS 9.8No exploitEPSS 10%

    mozilla · firefoxJan 7, 2025

  • CVE-2024-50603
    99Now

    An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996.

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    aviatrix · controllerJan 7, 2025

  • CVE-2024-12585
    24Monitor

    PropertyHive < 2.1.1 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    wp-property-hive · propertyhiveJan 8, 2025

  • CVE-2024-11613
    40Plan

    WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    iptanus · wordpress file uploadJan 8, 2025

  • CVE-2024-11635
    39Monitor

    WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    iptanus · wordpress file uploadJan 8, 2025

  • CVE-2024-54676
    60This week

    Apache OpenMeetings: Deserialisation of untrusted data in cluster mode

    CriticalCVSS 9.8No exploitEPSS 68%

    apache · openmeetingsJan 8, 2025

  • CVE-2024-11423
    30Monitor

    Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch

    HighCVSS 7.5Proof of conceptEPSS 0%

    wp swings · gift cards for woocommerce proJan 8, 2025

  • CVE-2024-55656
    40Plan

    RedisBloom Integer Overflow Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 17%

    redisbloom · redisbloomJan 8, 2025

  • CVE-2024-51442
    36Monitor

    Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna

    HighCVSS 8.8Proof of conceptEPSS 2%

    Jan 8, 2025

  • CVE-2024-53995
    7Monitor

    GHSL-2024-288: SickChill open redirect in login

    LowCVSS 1.9Proof of conceptEPSS 1%

    sickchill · sickchillJan 8, 2025

  • CVE-2025-0283
    33Monitor

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neu

    HighCVSS 7.0Proof of conceptEPSS 17%

    ivanti · connect secureJan 8, 2025

  • CVE-2025-0282
    96Now

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neu

    CriticalCVSS 9.0KEVWeaponizedEPSS 99%

    ivanti · connect secureJan 8, 2025

  • CVE-2024-53704
    98Now

    An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    sonicwall · sonicosJan 9, 2025

  • CVE-2024-12542
    34Monitor

    linkID <= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure

    HighCVSS 8.6Proof of conceptEPSS 1%

    linkid · linkidJan 9, 2025

  • CVE-2023-24012
    32Monitor

    Data Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Open DDS

    HighCVSS 8.2Proof of conceptEPSS 0%

    opendds · ddsJan 9, 2025

  • CVE-2025-22510
    28Monitor

    WordPress WC Price History for Omnibus plugin <= 2.1.4 - PHP Object Injection vulnerability

    HighCVSS 7.2Proof of conceptEPSS 1%

    kkarpieszuk · wc price history for omnibusJan 9, 2025

  • CVE-2024-54761
    26Monitor

    BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter.

    MediumCVSS 6.3Proof of conceptEPSS 1%

    bigantsoft · bigant office messenger 5Jan 9, 2025

  • CVE-2024-54887
    34Monitor

    TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /user

    HighCVSS 8.0Proof of conceptEPSS 6%

    tp-link · tl-wr940n firmwareJan 9, 2025

  • CVE-2023-28354
    39Monitor

    An issue was discovered in Opsview Monitor Agent 6.8.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    Jan 9, 2025

  • CVE-2025-21385
    34Monitor

    Microsoft Purview Information Disclosure Vulnerability

    MediumCVSS 6.5Proof of conceptEPSS 28%

    microsoft · purviewJan 9, 2025

  • CVE-2024-56511
    52Plan

    DataEase has an unauthorized vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 50%

    dataease · dataeaseJan 10, 2025

  • CVE-2024-54910
    18Monitor

    Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.

    MediumCVSS 4.7Proof of conceptEPSS 0%

    Jan 10, 2025

  • CVE-2024-12847
    48Plan

    NETGEAR DGN setup.cgi OS Command Injection

    CriticalCVSS 9.8WeaponizedEPSS 30%

    netgear · dgn1000 firmwareJan 10, 2025

  • CVE-2024-33297
    18Monitor

    Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal

    MediumCVSS 4.7Proof of conceptEPSS 1%

    microweber · microweberJan 10, 2025

  • CVE-2024-33298
    24Monitor

    Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new ba

    MediumCVSS 6.1Proof of conceptEPSS 0%

    microweber · microweberJan 10, 2025

  • CVE-2024-33299
    18Monitor

    Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name

    MediumCVSS 4.7Proof of conceptEPSS 1%

    microweber · microweberJan 10, 2025

  • CVE-2024-12404
    30Monitor

    CF Internal Link Shortcode <= 1.1.0 - Unauthenticated SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 0%

    crowdfavorite · cf internal link shortcodeJan 10, 2025

  • CVE-2025-0105
    31Monitor

    Expedition: Arbitrary File Deletion Vulnerability

    MediumCVSS 6.9No exploitEPSS 13%

    paloaltonetworks · expeditionJan 10, 2025

  • CVE-2025-0107
    54Plan

    Expedition: OS Command Injection Vulnerability

    HighCVSS 7.7Proof of conceptEPSS 78%

    paloaltonetworks · expeditionJan 10, 2025

  • CVE-2024-12877
    39Monitor

    GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    givewp · givewpJan 11, 2025

  • CVE-2025-0401
    27Monitor

    1902756969 reggie CommonController.java download path traversal

    MediumCVSS 6.9Proof of conceptEPSS 1%

    1902756969 · reggieJan 12, 2025

  • CVE-2025-22828
    18Monitor

    Apache CloudStack: Unauthorised access to annotations

    MediumCVSS 4.3Proof of conceptEPSS 1%

    apache · cloudstackJan 13, 2025

  • CVE-2025-22777
    39Monitor

    WordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    givewp · givewpJan 13, 2025

  • CVE-2025-22963
    30Monitor

    Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.

    HighCVSS 7.5Proof of conceptEPSS 0%

    sismics · teedyJan 13, 2025

  • CVE-2024-57487
    27Monitor

    In Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker

    MediumCVSS 6.5WeaponizedEPSS 2%

    code-projects · online car rental systemJan 13, 2025

  • CVE-2024-46310
    37Monitor

    Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via expose

    CriticalCVSS 9.1Proof of conceptEPSS 2%

    Jan 13, 2025

  • CVE-2024-11396
    22Monitor

    Event monster <= 1.4.3 - Information Exposure Via Visitors List Export

    MediumCVSS 5.3Proof of conceptEPSS 2%

    awplife · event monsterJan 13, 2025

  • CVE-2024-12008
    31Monitor

    W3 Total Cache <= 2.8.1 Information Exposure via Log Files

    HighCVSS 7.5Proof of conceptEPSS 2%

    boldgrid · w3 total cacheJan 14, 2025

  • CVE-2024-12365
    35Monitor

    W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery

    HighCVSS 8.5Proof of conceptEPSS 1%

    boldgrid · w3 total cacheJan 14, 2025

  • CVE-2024-48884
    41Plan

    A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1,

    CriticalCVSS 9.1No exploitEPSS 15%

    fortinet · fortimanagerJan 14, 2025

  • CVE-2024-55591
    97Now

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and Forti

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    fortinet · fortiproxyJan 14, 2025

  • CVE-2024-7344
    32Monitor

    Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.

    HighCVSS 8.2Proof of conceptEPSS 1%

    howyar · sysreturnJan 14, 2025

  • CVE-2024-21797
    34Monitor

    A command execution vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505.

    HighCVSS 7.2No exploitEPSS 20%

    wavlink · wl-wn533a8 firmwareJan 14, 2025

  • CVE-2024-34166
    44Plan

    An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505.

    CriticalCVSS 9.8No exploitEPSS 15%

    wavlink · wl-wn533a8 firmwareJan 14, 2025

  • CVE-2024-36258
    43Plan

    A stack-based buffer overflow vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210

    CriticalCVSS 9.8No exploitEPSS 12%

    wavlink · wl-wn533a8 firmwareJan 14, 2025

  • CVE-2024-36295
    34Monitor

    A command execution vulnerability exists in the qos.cgi qos_sta() functionality of Wavlink AC3000 M33A8.V5030.210505.

    HighCVSS 7.2No exploitEPSS 20%

    wavlink · wl-wn533a8 firmwareJan 14, 2025

  • CVE-2024-37186
    35Monitor

    An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505.

    HighCVSS 7.2No exploitEPSS 22%

    wavlink · wl-wn533a8 firmwareJan 14, 2025

  • CVE-2024-38666
    42Plan

    An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505

    CriticalCVSS 9.1No exploitEPSS 18%

    wavlink · wl-wn533a8 firmwareJan 14, 2025

  • CVE-2024-39280
    46Plan

    An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505.

    CriticalCVSS 9.1No exploitEPSS 34%

    wavlink · wl-wn533a8 firmwareJan 14, 2025

  • CVE-2024-39288
    32Monitor

    A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505.

    HighCVSS 7.2No exploitEPSS 13%

    wavlink · wl-wn533a8 firmwareJan 14, 2025

  • CVE-2024-39360
    32Monitor

    An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505.

    HighCVSS 7.2No exploitEPSS 11%

    wavlink · wl-wn533a8 firmwareJan 14, 2025

  • CVE-2024-39363
    38Monitor

    A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505

    MediumCVSS 6.1No exploitEPSS 48%

    wavlink · wl-wn533a8 firmwareJan 14, 2025

  • CVE-2024-39760
    44Plan

    Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505.

    CriticalCVSS 9.8No exploitEPSS 17%

    wavlink · wl-wn533a8 firmwareJan 14, 2025

  • CVE-2024-13179
    58Plan

    Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.

    CriticalCVSS 9.8No exploitEPSS 62%

    ivanti · avalancheJan 14, 2025

  • CVE-2024-13180
    38Monitor

    Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information.

    HighCVSS 7.5No exploitEPSS 27%

    ivanti · avalancheJan 14, 2025

  • CVE-2024-13181
    49Plan

    Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.

    CriticalCVSS 9.8No exploitEPSS 32%

    ivanti · avalancheJan 14, 2025

  • CVE-2024-13159
    90Now

    Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    ivanti · endpoint managerJan 14, 2025