CVEs published October 16, 2024
185 CVEs were published on October 16, 2024: 33 critical, 65 high. Browse them by severity, product and exploitation status.
- Published
- 185
- Critical
- 33
- High
- 65
- Medium
- 84
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 59
Most affected products
- Cisco Analog Telephone Adaptor (ATA) Software
- 8
- paytiumsupport Paytium: Mollie payment forms & donations
- 8
- SUSE rancher · github.com/rancher/rancher
- 6
- OISF suricata
- 5
- OpenText Application Automation Tools
- 5
- code-projects Pharmacy Management System
- 4
- Apache Software Foundation Apache CloudStack
- 3
- File Manager Pro
- 3
- Apache Software Foundation Apache Solr · org.apache.solr:so…
- 2
- Autodesk Revit
- 2
Critical 33
- CVE-2024-9893Nextend Social Login Pro <= 3.1.14 - Authentication Bypass via WordPress.com OAuth providernextendweb Nextend Social Login Pro
- CVE-2024-48034WordPress Creates 3D Flipbook, PDF Flipbook plugin <= 1.2 - Arbitrary File Upload vulnerabilityfliperrr Creates 3D Flipbook, PDF Flipbook
- CVE-2024-49216WordPress Feed Comments Number plugin <= 0.2.1 - Arbitrary File Upload vulnerabilityjclay06 Feed Comments Number
- CVE-2024-49242WordPress Digital Lottery plugin <= 3.0.5 - Arbitrary File Upload vulnerabilityShafiq Digital Lottery
- CVE-2024-49260WordPress Limb Gallery plugin <= 1.5.7 - Arbitrary File Upload vulnerabilityLimbcode WordPress Gallery Plugin – Limb Image Gallery
- CVE-2024-48026WordPress Disc Golf Manager plugin <= 1.0.0 - PHP Object Injection vulnerabilityGMRobbins Disc Golf Manager
- CVE-2024-48028WordPress IP Loc8 plugin <= 1.1 - PHP Object Injection vulnerabilityBoyan Raichev IP Loc8
- CVE-2024-48030WordPress Telecash Ricaricaweb plugin <= 2.2 - PHP Object Injection vulnerabilityWebextends Telecash Ricaricaweb
- CVE-2024-49218WordPress Recently plugin <= 1.1 - PHP Object Injection vulnerabilityAl Imran Akash Recently
- CVE-2024-49254WordPress ajax-extend plugin <= 1.0 - Remote Code Execution (RCE) vulnerabilitysunjianle ajax-extend
- CVE-2024-47649WordPress Iconize plugin <= 1.2.4 - Remote Code Execution (RCE) vulnerabilityTHATplugin Iconize
- CVE-2024-48027WordPress External featured image from bing plugin <= 1.0.2 - Remote Code Execution (RCE) vulnerabilityxaraartech External featured image from bing
- CVE-2024-48035WordPress ACF Images Search And Insert plugin <= 1.1.4 - Arbitrary File Upload vulnerabilitytakayukii ACF Images Search And Insert
- CVE-2024-48042WordPress Contact Form by Supsystic plugin <= 1.7.28 - Remote Code Execution (RCE) vulnerabilityContact Form by Supsystic
- CVE-2024-49257WordPress Azz Anonim Posting plugin <= 0.9 - Arbitrary File Upload vulnerabilityDenis Azz Anonim Posting
- CVE-2024-49271WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.121 - Remote Code Execution (RCE) vulnerabilityUnlimited Elements For Elementor
- CVE-2024-49247WordPress BuddyPress Better Registration plugin <= 1.6 - Broken Authentication vulnerabilitySK BuddyPress Better Registration
- CVE-2023-32191rke's credentials are stored in the RKE1 Cluster state ConfigMapSUSE rke · github.com/rancher/rke
- CVE-2023-32188JWT token compromise can allow malicious actions including Remote Code Execution (RCE)SUSE neuvector · github.com/neuvector/neuvector
- CVE-2024-45216Apache Solr: Authentication bypass possible using a fake URL Path endingApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2016-15042Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Uploadnmedia N-Media Post Front-end Form · nmedia Frontend File M…
- CVE-2018-25105File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Downloadmndpsingh287 File Manager
- CVE-2020-36832Indeed Membership Pro 7.3 - 8.6 - Authentication Bypasswpindeed Indeed Membership Pro
- CVE-2020-36837ThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site ResetThemeGrill Demo Importer
- CVE-2019-25217SiteGround Optimizer <= 5.0.12 - Missing Authorizationsiteground Speed Optimizer – The All-In-One Performance-Boo…
Show all 33 entriesShow fewer entries
- CVE-2019-25213Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Readvasyltech Advanced Access Manager – Access Governance for W…
- CVE-2016-15040Kento Post View Counter <= 2.8 - SQL InjectionKento Post View Counter
- CVE-2021-4449ZoomSounds <= 5.96 - Unauthenticated Arbitrary File UploadZoomIt ZoomSounds - WordPress Wave Audio Player with Playli…
- CVE-2021-4443WordPress Mega Menu <= 2.0.6 - Arbitrary File Creationquadlayers QuadMenu – Mega Menu
- CVE-2024-10018Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component.TECNO com.transsion.aivoiceassistant
- CVE-2024-9105UltimateAI <= 2.8.3 - Authentication BypassTophive Ultimate AI
- CVE-2024-9634GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Executionstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-48180ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to…
High 65
- CVE-2024-7994Stack-Based Buffer Overflow Vulnerability in Autodesk RevitAutodesk Revit
- CVE-2024-7993Out-of-Bounds Write Vulnerability in Autodesk RevitAutodesk Revit
- CVE-2024-48918Lack of Input Validation in RDS Light - Potential for Injection Attacks and Memory TamperingRDSaiPlatforms RDSlight
- CVE-2024-47522Suricata ja4: invalid alpn leads to panicOISF suricata
- CVE-2024-47188Suricata http/byte-ranges: missing hashtable random seed leads to potential DoSOISF suricata
- CVE-2024-47187Suricata datasets: missing hashtable random seed leads to potential DoSOISF suricata
- CVE-2024-45797LibHTP's unbounded header handling leads to denial serviceOISF libhtp
- CVE-2024-45795Suricata detect/datasets: reachable assertion with unimplemented rule optionOISF suricata
- CVE-2024-9143Low-level invalid GF(2^m) parameters lead to OOB memory accessOpenSSL
- CVE-2024-38814An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware.VMware HCX
- CVE-2024-20458Cisco ATA 190 Series Analog Telephone Adapter Software VulnerabilitiesCisco Analog Telephone Adaptor (ATA) Software
- CVE-2024-20421Cisco ATA 190 Series Analog Telephone Adapter Firmware Cross-Site Request Forgery VulnerabilityCisco Analog Telephone Adaptor (ATA) Software
- CVE-2024-9348Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build viewDocker Desktop
- CVE-2024-49268WordPress disconnected theme <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilitysunburntkamel disconnected
- CVE-2024-45844BIG-IP monitors vulnerabilityF5 BIG-IP
- CVE-2024-49245WordPress Ahime Image Printer plugin <= 1.0.0 - Arbitrary File Download vulnerabilitynahimsalami Ahime Image Printer
- CVE-2024-47351WordPress MaxSlider plugin <= 1.2.3 - Local File Inclusion vulnerabilityThe CSSIgniter Team MaxSlider
- CVE-2024-47645WordPress WPOptin plugin <= 2.0.1 - Local File Inclusion vulnerabilityDanish Ali Malik Top Bar – PopUps – by WPOptin
- CVE-2024-48029WordPress SB Random Posts Widget plugin <= 1.0 - Local File Inclusion vulnerabilityHung Trang Si SB Random Posts Widget
- CVE-2024-49251WordPress Maan Addons For Elementor plugin <= 1.0.1 - Local File Inclusion vulnerabilityAcnoo Maan Addons For Elementor
- CVE-2024-22030Rancher agents can be hijacked by taking over the Rancher Server URLSUSE rancher · github.com/rancher/rancher
- CVE-2024-22029tomcat packaging allows for escalation to root from tomcat userContainer suse/manager/5.0/x86_64/server:5.0.0-beta1.2.… +21
- CVE-2024-49226WordPress TAKETIN To WP Membership plugin <= 2.8.17 - PHP Object Injection vulnerabilityTAKETIN To WP Membership
- CVE-2024-49227WordPress Free Stock Photos Foter plugin <= 1.5.4 - PHP Object Injection vulnerabilityFree Stock Photos Foter
- CVE-2024-47637WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerabilityLiteSpeed Technologies LiteSpeed Cache
Show all 65 entriesShow fewer entries
- CVE-2024-49253WordPress Analyse Uploads plugin <= 0.5 - Arbitrary File Deletion vulnerabilityJamesPark.ninja Analyse Uploads
- CVE-2023-32194Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'SUSE rancher · github.com/rancher/rancher
- CVE-2023-32193Norman API Cross-site Scripting VulnerabilitySUSE norman · github.com/rancher/norman
- CVE-2023-32192Rancher API Server Cross-site Scripting VulnerabilitySUSE apiserver · github.com/rancher/apiserver
- CVE-2023-32190mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readableopenSUSE Tumbleweed
- CVE-2024-8040Authorization Bypass Through User-Controlled Key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024xDassault Systèmes 3DSwymer
- CVE-2024-6380Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x…Dassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2023-22650Rancher does not automatically clean up a user deleted or disabled from the configured Authentication ProviderSUSE rancher · github.com/rancher/rancher
- CVE-2024-45219Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructureApache Software Foundation Apache CloudStack
- CVE-2024-45693Apache CloudStack: Request origin validation bypass makes account takeover possibleApache Software Foundation Apache CloudStack
- CVE-2024-45217Apache Solr: ConfigSets created during a backup restore command are trusted implicitlyApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2023-22649Rancher 'Audit Log' leaks sensitive informationSUSE rancher · github.com/rancher/rancher
- CVE-2020-36842Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Uploadwpvividplugins WPvivid — Backup, Migration & Staging
- CVE-2021-4452Google Language Translator <= 6.0.9 - Reflected Cross-Site Scriptingedo888 Translate WordPress – Google Language Translator
- CVE-2020-36840Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorizationjetmonsters Timetable and Event Schedule by MotoPress
- CVE-2024-9061WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via…themehunk WP Popup Builder – Popup Forms and Marketing Lead…
- CVE-2024-45711SolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution VulnerabilitySolarWinds Serv-U
- CVE-2024-45715SolarWinds Platform Edit Function Cross-Site Scripting VulnerabilitySolarWinds Platform
- CVE-2024-45710SolarWinds Platform Uncontrolled Search Path Element Local Privilege Escalation VulnerabilitySolarWinds Platform
- CVE-2023-7294Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_profile'paytiumsupport Paytium: Mollie payment forms & donations
- CVE-2020-36839WP Lead Plus X <= 0.99 - Cross-Site Request Forgerybc2018 WordPress Landing Page – Squeeze Page – Responsive L…
- CVE-2024-8507File Manager Pro <= 8.3.9 - Cross-Site Request Forgery to Arbitrary File UploadFile Manager Pro
- CVE-2019-25216Rich Reviews <= 1.7.4 - Stored Cross-Site Scriptingstarfishwp Rich Reviews by Starfish
- CVE-2023-7291Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_account'paytiumsupport Paytium: Mollie payment forms & donations
- CVE-2019-25214ShopWP <= 2.0.4 - Missing Authorization to Stored Cross-Site Scriptingandrewmrobbins ShopWP
- CVE-2021-4447Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalationwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2016-15041MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site ScriptingMainWP Dashboard: Self-hosted WordPress Management for Agen…
- CVE-2022-4972Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Exportwpchill Download Monitor
- CVE-2021-4450Post Grid <= 2.1.12 - Contributor+ SQL Injectionpickplugins Post Grid
- CVE-2017-20192Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scriptingstrategy11team Formidable Forms – Contact Form Plugin, Surv…
- CVE-2024-8746File Manager Pro <= 8.3.9 - Unauthenticated Backup File Download and UploadFile Manager Pro
- CVE-2020-36836WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletionemrevona WP Fastest Cache – WordPress Cache Plugin
- CVE-2019-25215ARI-Adminer <= 1.1.14 - Missing Authorization and No Direct File Access Restrictionsarisoft ARI Adminer – WordPress Database Manager
- CVE-2012-10018Mapplic Lite and Mapplic <= (Various Versions) - Server Side Request Forgery to Cross-Site Scirptingsekler Mapplic Lite · sekler Mapplic - Custom Interactive M…
- CVE-2021-4448Kaswara Modern VC Addons <= 3.0.1 - Missing AuthorizationSayenThemes Kaswara Modern VC Addons
- CVE-2020-36838Facebook Chat Plugin <= 1.5 - Missing Capabilities CheckFacebook Chat Plugin – Live Chat Plugin for WordPress
- CVE-2021-4444Product Filter by WooBeWoo <= 1.4.9 - Missing Authorizationwoobewoo Product Filter for WooCommerce by WBW
- CVE-2024-8918File Manager Pro <= 8.3.9 - Unauthenticated Limited JavaScript File UploadFile Manager Pro
- CVE-2024-9305AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTPscottopolis AppPresser – Mobile App Framework
- CVE-2024-46213REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.
Medium, low and unrated 87
- CVE-2024-47889Action Mailer has possible ReDoS vulnerability in block_formatrails · actionmailer
- CVE-2024-47888Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_noderails · actiontext
- CVE-2024-47887Action Controller has possible ReDoS vulnerability in HTTP Token authenticationrails · actionpack
- CVE-2024-47836Admidio vulnerable to HTML Injection In The Messages Sectionadmidio · admidio/admidio
- CVE-2024-45796Suricata defrag: off by one can lead to policy bypassOISF suricata
- CVE-2024-41128Action Dispatch has possible ReDoS vulnerability in query parameter filteringrails · actionpack
- CVE-2024-10033Aap-gateway: xss on aap-gatewayaap-gateway · Red Hat Ansible Automation Platform 2.5 for R…
- CVE-2024-4692Multiple missing permission checksOpenText Application Automation Tools
- CVE-2024-4690Insecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation ToolsOpenText Application Automation Tools
- CVE-2024-4211Multiple missing permission checksOpenText Application Automation Tools
- CVE-2024-4189Multiple XXE sinks in Run LoadRunner script step in OpenText Application Automation ToolsOpenText Application Automation Tools
- CVE-2024-4184Multiple XXE sinks in ALM archive post-build step in OpenText Application Automation ToolsOpenText Application Automation Tools
- CVE-2023-32266Code injection vulnerability found in OpenText Application Lifecycle Management (ALM),Quality Center.OpenText™ Application Lifecycle Management (ALM),Quality Ce…
- CVE-2024-45071IBM WebSphere Application Server cross-site scriptingIBM WebSphere Application Server
- CVE-2024-20512Cisco Unified Contact Center Management Portal Reflected Cross-Site Scripting VulnerabilityCisco Unified Contact Center Management Portal
- CVE-2024-20463Cisco ATA 190 Series Analog Telephone Adapter Firmware Command Injection and Denial of Service VulnerabilityCisco Analog Telephone Adaptor (ATA) Software
- CVE-2024-20462Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure VulnerabilityCisco Analog Telephone Adaptor (ATA) Software
- CVE-2024-20461Cisco ATA 190 Series Analog Telephone Adapter Firmware Command Injection VulnerabilityCisco Analog Telephone Adaptor (ATA) Software
- CVE-2024-20460Cisco ATA 190 Series Analog Telephone Adapter Firmware Reflected Cross-Site Scripting VulnerabilityCisco Analog Telephone Adaptor (ATA) Software
- CVE-2024-20459Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Command Injection VulnerabilityCisco Analog Telephone Adaptor (ATA) Software
- CVE-2024-20420Cisco ATA 190 Series Analog Telephone Adapter Firmware Privilege Escalation VulnerabilityCisco Analog Telephone Adaptor (ATA) Software
- CVE-2024-20280Cisco UCS Central Software Configuration Backup Static Key VulnerabilityCisco Unified Computing System Central Software
- CVE-2024-45072IBM WebSphere Application Server XML external entity injectionIBM WebSphere Application Server
- CVE-2024-29155Denial of service on Microchip RN4870 devicesMicrochip RN4870
- CVE-2024-49265WordPress Booking.com Banner Creator plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerabilitySPBooking.com Booking.com Banner Creator
Show all 87 entriesShow fewer entries
- CVE-2024-49266WordPress WP-Spreadplugin plugin <= 4.8.9 - Cross Site Scripting (XSS) vulnerabilityThimo Grauerholz WP-Spreadplugin
- CVE-2024-49267WordPress Unlimited Addon For Elementor plugin <=2.0.0 - Cross Site Scripting (XSS) vulnerabilitynayon46 Unlimited Addon For Elementor
- CVE-2024-47139F5 BIG-IQ VulnerabilityF5 BIG-IQ
- CVE-2024-49270WordPress Smart Blocks plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityhashthemes Smart Blocks
- CVE-2023-32189Insecure handling SSH key in SUSE Manager when bootstrapping new clientsSUSE Manager Server Module
- CVE-2024-49252WordPress leyka plugin <=3.31.6 - Broken Access Control vulnerabilityVaultDweller Leyka
- CVE-2024-22034Crafted projects can overwrite special files in the .osc config directorySUSE Linux Enterprise Desktop 15 SP5 · SUSE Linux Enter… +13
- CVE-2024-49258WordPress Limb Gallery plugin <= 1.5.7 - Arbitrary File Download vulnerabilityLimbcode WordPress Gallery Plugin – Limb Image Gallery
- CVE-2024-22033obs-service-download_url is vulnerable to argument injectionSUSE Package Hub 15 SP5 · SUSE Package Hub 15 SP6 +2
- CVE-2024-22032Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpecSUSE rancher · github.com/rancher/rancher
- CVE-2023-32196Rancher's External RoleTemplates can lead to privilege escalationSUSE rancher · github.com/rancher/rancher
- CVE-2024-10024code-projects Pharmacy Management System manage_medicine_stock.php sql injectioncode-projects Pharmacy Management System
- CVE-2024-10023code-projects Pharmacy Management System add_new_medicine.php sql injectioncode-projects Pharmacy Management System
- CVE-2020-36841WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon CreationWooCommerce Smart Coupons
- CVE-2024-10022code-projects Pharmacy Management System manage_supplier.php sql injectioncode-projects Pharmacy Management System
- CVE-2024-10021code-projects Pharmacy Management System manage_purchase.php sql injectioncode-projects Pharmacy Management System
- CVE-2024-8921Zita Elementor Site Library <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadwpzita Zita Site Library for Elementor
- CVE-2024-9444ElementsReady Addons for Elementor <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadquomodosoft ElementsReady Addons for Elementor
- CVE-2024-9858Insecure user permissions in Google Cloud Migrate to Containers for WindowsGoogle Cloud Migrate to Containers
- CVE-2024-45461Apache CloudStack Quota plugin: Access checks not enforced in QuotaApache Software Foundation Apache CloudStack Quota plugin
- CVE-2024-45462Apache CloudStack: Incomplete session invalidation on web interface logoutApache Software Foundation Apache CloudStack
- CVE-2023-7295Video Grid <= 1.21 - Reflected Cross-Site Scriptingnik00726 Video Grid
- CVE-2017-20194Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosurestrategy11team Formidable Forms – Contact Form Plugin, Surv…
- CVE-2024-9540Sina Extension for Elementor <= 3.5.7 - Authenticated (Contributor+) Sensitive Information Exposure via Sina Modal Box Widget Elementor…shaonsina Sina Extension for Elementor
- CVE-2017-20193Product Vendors <= 2.0.35 - Reflected Cross Site ScriptingWooCommerce Product Vendors
- CVE-2023-7296BigBlueButton <= 3.0.0-beta.4 - Authenticated (Author+) Stored Cross-Site Scriptingblindsidenetworks BigBlueButton
- CVE-2024-45714SolarWinds Serv-U Stored XSS VulnerabilitySolarWinds Serv-U
- CVE-2023-7293Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_mollie_account_details'paytiumsupport Paytium: Mollie payment forms & donations
- CVE-2023-7292Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_notice_dismiss'paytiumsupport Paytium: Mollie payment forms & donations
- CVE-2021-4445Premium Addons for Elementor <= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option Updateleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2022-4973WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); functionWordPress Foundation WordPress
- CVE-2023-7290Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_for_verified_profiles'paytiumsupport Paytium: Mollie payment forms & donations
- CVE-2020-36833Indeed Membership Pro 7.3 - 8.6 - Missing Authorization Checkswpindeed Indeed Membership Pro
- CVE-2023-7289Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_sw_save_api_keys'paytiumsupport Paytium: Mollie payment forms & donations
- CVE-2024-9582Accordion Slider <= 1.9.11 - Authenticted (Contributor+) Stored Cross-Site Scripting via HTML Attributebqworks Accordion Slider
- CVE-2020-36835Migration, Backup, Staging – WPvivid <= 0.9.35 - Sensitive Information Disclosurewpvividplugins WPvivid — Backup, Migration & Staging
- CVE-2022-4971Sassy Social Share <= 3.3.3 - Reflected Cross-Site Scriptingheateor Social Sharing Plugin – Sassy Social Share
- CVE-2023-7286ACF Quick Edit Fields <= 3.2.2 - Authenticated (Contributor+) Insecure Direct Object Referencepodpirate ACF Quick Edit Fields
- CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checksdashlabsltd YASR – Yet Another Star Rating Plugin for… +614
- CVE-2020-36831NextScripts: Social Networks Auto-Poster <= 4.3.17 - Missing AuthorizationNextScripts: Social Networks Auto-Poster
- CVE-2020-36834Discount Rules for WooCommerce <= 2.0.2 - Missing Authorizationflycart Discount Rules for WooCommerce
- CVE-2023-7288Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'update_profile_preference'paytiumsupport Paytium: Mollie payment forms & donations
- CVE-2021-4446Essential Addons for Elementor <= 4.6.4 - Missing Authorizationwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2021-4451NinjaFirewall <= 4.3.3 - Authenticated PHAR Deserializationnintechnet NinjaFirewall (WP Edition) – Advanced Security P…
- CVE-2023-7287Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'pt_cancel_subscription'paytiumsupport Paytium: Mollie payment forms & donations
- CVE-2024-9937Woo Manage Fraud Orders <= 2.6.1 - Reflected Cross-Site Scriptingprasidhda Woo Manage Fraud Orders
- CVE-2024-9888ElementInvader Addons for Elementor <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingElementInvader Addons for Elementor
- CVE-2024-9873Community by PeepSo <= 6.4.6.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingCommunity by PeepSo – Download from PeepSo.com
- CVE-2024-9647Kama SpamBlock <= 1.8.2 - Reflected Cross-Site Scriptingtkama Kama SpamBlock
- CVE-2024-9652Locatoraid Store Locator <= 3.9.47 - Reflected Cross-Site Scriptingplainware Locatoraid Store Locator
- CVE-2024-9891Multiline files upload for contact form 7 <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivationzluck MultiLine Files for Contact Form
- CVE-2024-9649WP ULike <= 4.7.4 - Cross-Site Request Forgery to Statistic Deletionalimir WP ULike – Like & Dislike Buttons for Engagement and…
- CVE-2024-9104UltimateAI <= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value CheckTophive Ultimate AI
- CVE-2024-8787Smart Online Order for Clover <= 1.5.7 - Reflected Cross-Site Scriptingelbanyaoui Smart Online Order for Clover
- CVE-2024-8541Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons <= 2.6.5 - Reflected Cross-Site…flycart Discount Rules for WooCommerce
- CVE-2024-9521SEO Manager <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Metaindia-web-developer SEO Manager
- CVE-2024-44762A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.
- CVE-2024-46212An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.redaxo/source
- CVE-2024-46605A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary…
- CVE-2024-46606A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary…
- CVE-2024-48744A Reflected Cross Site Scripting (XSS) vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management…
- CVE-2024-48758dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the addPro parameter of the component…