By publication date

Exploited and new serious CVEs: January 2025

219 records · 17 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 3 of 3

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
31Monitor	CVE-2024-23733Proof of concept	The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote CWE-522 Pre-auth Info leak	High7.5	—	2.4%	Jan 29, 2025
44Plan	CVE-2025-0851Proof of concept	Path traversal issue in Deep Java Libraryaws · deepjavalibrary · CWE-36 Pre-auth Path traversal	Critical9.3	—	23.2%	Jan 29, 2025
28Monitor	CVE-2024-12638Proof of concept	Bulk Me Now <= 2.0 - Reflected XSSombu · bulk me now\! · CWE-79 Pre-auth XSS	High7.1	—	0.5%	Jan 30, 2025
26Monitor	CVE-2024-53615Proof of concept	A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remotCWE-77 pre-auth RCE Command injection	Medium6.5	—	1.3%	Jan 30, 2025
27Monitor	CVE-2024-55415Proof of concept	DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass.thecontrolgroup · voyager · CWE-22 Path traversal	Medium5.7	—	15.5%	Jan 30, 2025
20Monitor	CVE-2024-55416Proof of concept	DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass.thecontrolgroup · voyager · CWE-79 XSS	Low3.5	—	20.2%	Jan 30, 2025
21Monitor	CVE-2024-55417Proof of concept	DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /athecontrolgroup · voyager · CWE-434 RCE File upload	Medium4.3	—	14.1%	Jan 30, 2025
24Monitor	CVE-2024-13112Proof of concept	WP MediaTagger <= 4.1.1 - Reflected XSSphd38 · wp mediatagger · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Jan 31, 2025
24Monitor	CVE-2024-13219Proof of concept	Policy Genius <= 2.0.4 - Reflected XSSwaelhassan · privacy policy genius · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Jan 31, 2025
24Monitor	CVE-2024-13220Proof of concept	Google Map Professional <= 1.0 - Reflected XSSpragmasoftwares · google map professional · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Jan 31, 2025
24Monitor	CVE-2024-13221Proof of concept	Fantastic Elasticsearch <= 4.1.0 - Reflected XSSparisholley · fantastic elasticsearch · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Jan 31, 2025
24Monitor	CVE-2024-13222Proof of concept	User Messages <= 1.2.4 - Reflected XSSmarvinlabs · user messages · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Jan 31, 2025
24Monitor	CVE-2024-13224Proof of concept	SlideDeck 1 Lite Content Slider <= 1.4.8 - Reflected XSSdtelepathy · slidedeck 1 lite content slider · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Jan 31, 2025
24Monitor	CVE-2024-13225Proof of concept	ECT Home Page Products <= 1.9 - Reflected XSSetemplates · ect home page products · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Jan 31, 2025
24Monitor	CVE-2024-13226Proof of concept	A5 Custom Login Page <= 2.8.1 - Reflected XSStepelstreel · a5 custom login page · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Jan 31, 2025
44Plan	CVE-2024-52875Proof of concept	An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5.gfi · kerio control · CWE-113 pre-auth RCE XSS Open redirect	High8.8	—	29.3%	Jan 31, 2025
37Monitor	CVE-2024-53537Proof of concept	An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager.openpanel · openpanel · CWE-22 Pre-auth Path traversal	Critical9.1	—	2.3%	Jan 31, 2025
31Monitor	CVE-2024-53582Proof of concept	An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory travopenpanel · openpanel · CWE-22 Pre-auth Path traversal	High7.5	—	3.2%	Jan 31, 2025
40Plan	CVE-2024-53584Proof of concept	OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter.openpanel · openpanel · CWE-78 pre-auth RCE Command injection	Critical9.8	—	4.1%	Jan 31, 2025

CVE-2024-23733
31Monitor
The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
- Info leak
Jan 29, 2025
CVE-2025-0851
44Plan
Path traversal issue in Deep Java Library
CriticalCVSS 9.3Proof of conceptEPSS 23%
- Pre-auth
- Path traversal
aws · deepjavalibraryJan 29, 2025
CVE-2024-12638
28Monitor
Bulk Me Now <= 2.0 - Reflected XSS
HighCVSS 7.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
ombu · bulk me now\!Jan 30, 2025
CVE-2024-53615
26Monitor
A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remot
MediumCVSS 6.5Proof of conceptEPSS 1%
- pre-auth RCE
- Command injection
Jan 30, 2025
CVE-2024-55415
27Monitor
DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass.
MediumCVSS 5.7Proof of conceptEPSS 15%
- Path traversal
thecontrolgroup · voyagerJan 30, 2025
CVE-2024-55416
20Monitor
DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass.
LowCVSS 3.5Proof of conceptEPSS 20%
- XSS
thecontrolgroup · voyagerJan 30, 2025
CVE-2024-55417
21Monitor
DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /a
MediumCVSS 4.3Proof of conceptEPSS 14%
- RCE
- File upload
thecontrolgroup · voyagerJan 30, 2025
CVE-2024-13112
24Monitor
WP MediaTagger <= 4.1.1 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
phd38 · wp mediataggerJan 31, 2025
CVE-2024-13219
24Monitor
Policy Genius <= 2.0.4 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
waelhassan · privacy policy geniusJan 31, 2025
CVE-2024-13220
24Monitor
Google Map Professional <= 1.0 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
pragmasoftwares · google map professionalJan 31, 2025
CVE-2024-13221
24Monitor
Fantastic Elasticsearch <= 4.1.0 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
parisholley · fantastic elasticsearchJan 31, 2025
CVE-2024-13222
24Monitor
User Messages <= 1.2.4 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
marvinlabs · user messagesJan 31, 2025
CVE-2024-13224
24Monitor
SlideDeck 1 Lite Content Slider <= 1.4.8 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
dtelepathy · slidedeck 1 lite content sliderJan 31, 2025
CVE-2024-13225
24Monitor
ECT Home Page Products <= 1.9 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
etemplates · ect home page productsJan 31, 2025
CVE-2024-13226
24Monitor
A5 Custom Login Page <= 2.8.1 - Reflected XSS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
tepelstreel · a5 custom login pageJan 31, 2025
CVE-2024-52875
44Plan
An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5.
HighCVSS 8.8Proof of conceptEPSS 29%
gfi · kerio controlJan 31, 2025
CVE-2024-53537
37Monitor
An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager.
CriticalCVSS 9.1Proof of conceptEPSS 2%
- Pre-auth
- Path traversal
openpanel · openpanelJan 31, 2025
CVE-2024-53582
31Monitor
An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory trav
HighCVSS 7.5Proof of conceptEPSS 3%
- Pre-auth
- Path traversal
openpanel · openpanelJan 31, 2025
CVE-2024-53584
40Plan
OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter.
CriticalCVSS 9.8Proof of conceptEPSS 4%
- pre-auth RCE
- Command injection
openpanel · openpanelJan 31, 2025