CVEs published April 15, 2024
219 CVEs were published on April 15, 2024: 11 critical, 51 high.
- Published
- 219
- Critical
- 11
- High
- 51
- Medium
- 156
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 41
Most affected products
- WBSAirback White Bear Solutions
- 16
- Combodo iTop
- 9
- HCL Software DevOps Deploy / Launch
- 4
- Lenovo SMM, SMM2, FPC
- 4
- PHPGurukul Student Record System
- 3
- aEnrich Technology a+HRD
- 2
- Ai3 QbiBot
- 2
- DMG MORI Digital Co., LTD. and NEXT Co. Cente IPv6
- 2
- KEYENCE KV STUDIO · KEYENCE KV REPLAY VIEWER +1
- 2
- Lenovo Windows 7 and 8 PC Preloads
- 2
Critical 11
- CVE-2023-48710iTop limit pages/exec.php script to PHP filesCombodo iTop
- CVE-2024-3781OS Command Injection vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-23486Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker wiBUFFALO WSR-2533DHP · BUFFALO WSR-2533DHPL +2
- CVE-2024-3701Improper Authentication in com.transsion.kolun.aiserviceTECNO com.transsion.kolun.aiservice
- CVE-2024-32128WordPress Realtyna Organic IDX plugin + WPL Real Estate plugin <= 4.14.4 - Unauthenticated SQL Injection vulnerabilityRealtyna Organic IDX plugin
- CVE-2024-3777Ai3 QbiBot - Broken Access ControlAi3 QbiBot
- CVE-2024-24486An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to edit device settings via the SAVE EEP_DATA comma
- CVE-2024-28056Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects.@aws-amplify/cli
- CVE-2024-28556SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate p
- CVE-2024-28557SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate p
- CVE-2024-31650A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via
High 51
- CVE-2024-2424Rockwell Automation Input/Output Device Vulnerable to Major Nonrecoverable FaultRockwell Automation 5015-AENFTXT
- CVE-2024-3493Rockwell Automation ControlLogix and GaurdLogix Vulnerable to Major Nonrecoverable Fault Due to Invalid Header ValueRockwell Automation ControlLogix · Rockwell Automation G… +2
- CVE-2024-2659 A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to exeLenovo SMM, SMM2, FPC
- CVE-2023-4857 An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI caLenovo SMM, SMM2, FPC
- CVE-2023-4856 A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a Lenovo SMM, SMM2, FPC
- CVE-2023-4855 A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to exeLenovo SMM, SMM2, FPC
- CVE-2023-48709iTop vulnerable to potential formula injection in Excel/CSV export fileCombodo iTop
- CVE-2023-47626iTop vulnerable to XSS vulnerability in authent-tokenCombodo iTop
- CVE-2023-47622iTop vulnerable to XSS vulnerability in dashlet refreshCombodo iTop
- CVE-2023-47123iTop vulnerable to XSS vulnerability in n:n relations "tagset" widgetCombodo iTop
- CVE-2024-3783Path Traversal vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3782Cross-Site Request Forgery (CSRF) vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3780Information exposure vulnerability on Technicolor CGA2121Technicolor CGA2121
- CVE-2024-23911Out-of-bounds read vulnerability caused by improper checking of the option length values in IPv6 NDP packets exists in Cente middleware TCP/DMG MORI Digital Co., LTD. and NEXT Co. Cente IPv6
- CVE-2024-30220Command injection vulnerability in PLANEX COMMUNICATIONS wireless LAN routers allows a network-adjacent unauthenticated attacker to execute PLANEX COMMUNICATIONS MZK-MF300N · PLANEX COMMUNICATIONS MZ…
- CVE-2024-29219Out-of-bounds read vulnerability exists in KV STUDIO Ver.11.64 and earlier and KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.KEYENCE KV STUDIO · KEYENCE KV REPLAY VIEWER +1
- CVE-2024-29218Out-of-bounds write vulnerability exists in KV STUDIO Ver.11.64 and earlier, KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.6.KEYENCE KV STUDIO · KEYENCE KV REPLAY VIEWER +1
- CVE-2024-28099VT STUDIO Ver.8.32 and earlier contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries.KEYENCE VT STUDIO
- CVE-2024-31424WordPress Login with Phone Number plugin <= 1.6.93 - Cross Site Request Forgery (CSRF) vulnerabilityHamid Alinia Login with phone number
- CVE-2024-22437HPE MSA SAN Storage VSS Provider and CAPI Proxy Software, Elevation of PrivilegeHewlett Packard Enterprise HPE MSA SAN Storage VSS Provider…
- CVE-2024-22435HPE NonStop Web ViewPoint Enterprise software, Unauthorized accessHewlett Packard Enterprise HPE NonStop Web ViewPoint Enterp…
- CVE-2024-30545WordPress Social Author Bio plugin <= 2.4 - Stored XSS via Cross Site Request Forgery (CSRF) vulnerabilityNick Powers Social Author Bio
- CVE-2024-31086WordPress Change default login logo,url and title plugin <= 2.0 - CSRF to XSS vulnerabilityVenugopal Change default login logo,url and title
- CVE-2024-31093WordPress Broken Images plugin <= 0.2 - CSRF to XSS vulnerabilityKaloyan K. Tsvetkov Broken Images
- CVE-2024-32082WordPress Sync Post With Other Site plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) to XSS vulnerabilityKamlesh Parmar Sync Post With Other Site
- CVE-2024-32087WordPress Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More plugin <= 3.5.7 - Auth. SQL Injection (SQLi) vulnerabilityExportFeed.com Product Feed on WooCommerce for Google
- CVE-2024-32098WordPress Advanced Page Visit Counter plugin <= 8.0.6 - Auth. SQL Injection (SQLi) vulnerabilityAdvanced Page Visit Counter
- CVE-2024-32125WordPress BA Book Everything plugin <= 1.6.4 - Auth. SQL Injection vulnerabilityBooking Algorithms BA Book Everything
- CVE-2024-32127WordPress Find Duplicates plugin <= 1.4.6 - Auth. SQL Injection vulnerabilityMarkus Seyer Find Duplicates
- CVE-2024-32132WordPress CBX Bookmark & Favorite plugin <= 1.7.20 - SQL Injection vulnerabilityCodeboxr Team CBX Bookmark & Favorite
- CVE-2024-32134WordPress Forms to Zapier plugin <= 1.1.12 - Auth. SQL Injection vulnerabilityNasirahmed Forms to Zapier, Integromat, IFTTT, Workato, Aut…
- CVE-2024-32135WordPress Disable Comments | WPZest plugin <= 1.51 - SQL Injection vulnerabilityDisable Comments | WPZest
- CVE-2024-32136WordPress BWL Advanced FAQ Manager plugin <= 2.0.3 - Auth. SQL Injection vulnerabilityXenioushk BWL Advanced FAQ Manager
- CVE-2024-32137WordPress User Activity Log Pro plugin <= 2.3.4 - Auth. SQL Injection vulnerabilitySolwin User Activity Log Pro
- CVE-2024-32139WordPress Podlove Podcast Publisher plugin <= 4.0.12 - SQL Injection vulnerabilityPodlove Podcast Publisher
- CVE-2024-32133WordPress EZ Form Calculator plugin <= 2.14.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMichael Schuppenies EZ Form Calculator
- CVE-2024-32138WordPress Short URL plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerabilityKaizenCoders Short URL
- CVE-2024-32145WordPress WP Google Analytics Events – No-Code Custom Event Tracking for Google Analytics plugin <= 2.8.0 - Reflected Cross-Site Scripting vulnerabilityPineWise WP Google Analytics Events
- CVE-2024-32149WordPress Jobs for WordPress plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerabilityBlueGlass Jobs for WordPress
- CVE-2024-2739Advance Search <= 1.1.6 - Shortcode Deletion via CSRFAdvanced Search
- CVE-2024-1755NPS computy <= 2.7.5 - Results Deletion via CSRFNPS computy
- CVE-2024-0399WooCommerce Customers Manager < 29.7 - Subscriber+ SQL InjectionWooCommerce Customers Manager
- CVE-2024-1655ASUS WiFi Router - OS Command InjectionASUS ExpertWiFi EBM63 · ASUS ExpertWiFi EBM68 +1
- CVE-2024-3769PHPGurukul Student Record System login.php sql injectionPHPGurukul Student Record System
- CVE-2024-3778Ai3 QbiBot - Unrestricted File UploadAi3 QbiBot
- CVE-2020-22539An arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows attackers to execute arbitrary code via uploadi
- CVE-2023-33806Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary comma
- CVE-2024-22014An issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated privileges via Symbol
- CVE-2024-24485An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to obtain sensitive information via the GET EEP_DAT
- CVE-2024-28558SQL Injection vulnerability in sourcecodester Petrol pump management software v1.0, allows remote attackers to execute arbitrary code, escal
- CVE-2024-32488In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the up
Medium, low and unrated 157
- CVE-2024-27794Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handledClaris FileMaker Server
- CVE-2024-23558HCL DevOps Deploy / HCL Launch does not invalidate all session authentication cookies after logoutHCL Software DevOps Deploy / Launch
- CVE-2024-23561HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerabilityHCL Software DevOps Deploy / Launch
- CVE-2024-32036SixLabors.ImageSharp vulnerable to data leakageSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2024-32035Memory Allocation with Excessive Size Value in SixLabors.ImageSharpSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2024-31990Argo CD' API server does not enforce project sourceNamespacesargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2024-3804Vesystem Cloud Desktop fileupload2.php unrestricted uploadVesystem Cloud Desktop
- CVE-2024-23560HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom type HCL Software DevOps Deploy / Launch
- CVE-2024-3803Vesystem Cloud Desktop fileupload.php unrestricted uploadVesystem Cloud Desktop
- CVE-2024-23594 A buffer overflow vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operatiLenovo Windows 7 and 8 PC Preloads
- CVE-2024-23593 A vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from Lenovo Windows 7 and 8 PC Preloads
- CVE-2024-31219Discourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity pagediscourse-reactions
- CVE-2024-23559HCL DevOps Deploy / Launch is generating an obsolete HTTP header HCL Software DevOps Deploy / Launch
- CVE-2023-45808iTop missing silo check on extkey in console and portalCombodo iTop
- CVE-2023-44396iTop vulnerable to XSS in dashlet modifications ajax endpointsCombodo iTop
- CVE-2023-43790iTop vulnerable to XSS in friendlyname in object detailsCombodo iTop
- CVE-2023-38511iTop Dashboard editor vulnerable dashboard config file parameterCombodo iTop
- CVE-2024-3797SourceCodester QR Code Bookmark System sql injectionSourceCodester QR Code Bookmark System
- CVE-2024-3796Cross-site Scripting vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3795Cross-site Scripting vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3794Cross-site Scripting vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3793Cross-site Scripting vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3792Cross-site Scripting vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3791Cross-site Scripting vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3790Cross-site Scripting vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3789Uncontrolled Resource Consumption vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3788Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3787Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3786Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3785Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-3784Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirbackWBSAirback White Bear Solutions
- CVE-2024-24898Information Leakage in kernelopenEuler kernel
- CVE-2024-24891Information Leakage in kernelopenEuler kernel
- CVE-2024-26023OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands.BUFFALO WCR-1166DS · BUFFALO WSR-1166DHP +5
- CVE-2024-28957Generation of predictable identifiers issue exists in Cente middleware TCP/IP Network Series.DMG MORI Digital Co., LTD. and NEXT Co. Cente TCP/IPv4 · DM…
- CVE-2024-28894Out-of-bounds read vulnerability caused by improper checking of the option length values in IPv6 headers exists in Cente middleware TCP/IP NDMG MORI Digital Co., LTD. and NEXT Co. Cente IPv6
- CVE-2024-30219Active debug code vulnerability exists in PLANEX COMMUNICATIONS wireless LAN routers.PLANEX COMMUNICATIONS MZK-MF300N · PLANEX COMMUNICATIONS MZ…
- CVE-2024-32129WordPress Freshdesk (official) plugin <= 2.3.6 - Open Redirection vulnerabilityFreshworks Freshdesk
- CVE-2024-30546WordPress Login With Ajax plugin <= 4.1 - Cross Site Request Forgery (CSRF) vulnerabilityPixelite Login With Ajax
- CVE-2024-31373WordPress E2Pdf plugin <= 1.20.27 - Cross Site Request Forgery (CSRF) vulnerabilitye2pdf
- CVE-2024-31374WordPress AppPresser plugin <= 4.3.0 - Cross Site Request Forgery (CSRF) vulnerabilityScott Bolinger AppPresser
- CVE-2024-31376WordPress Dashboard To-Do List plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityAndrew Dashboard To-Do List
- CVE-2024-31378WordPress MailChimp Forms by MailMunch plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityMailChimp Forms by MailMunch
- CVE-2024-31379WordPress Smash Balloon Social Post Feed plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerabilitySmash Balloon Social Post Feed
- CVE-2024-31381WordPress Spotlight Social Feeds plugin <= 1.6.10 - Cross Site Request Forgery (CSRF) vulnerabilityRebelCode Spotlight Social Media Feeds
- CVE-2024-31382WordPress Blocksy theme <= 2.0.22 - Cross Site Request Forgery (CSRF) vulnerabilitycreativethemeshq Blocksy
- CVE-2024-31383WordPress PopularFX theme <= 1.2.4 - Cross Site Request Forgery (CSRF) vulnerabilityPagelayer PopularFX
- CVE-2024-31384WordPress Spa and Salon theme <= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerabilityRara Theme Spa and Salon
- CVE-2024-31385WordPress ReDi Restaurant Reservation plugin <= 24.0128 - Cross Site Request Forgery (CSRF) vulnerabilityReservation Diary ReDi Restaurant Reservation
- CVE-2024-31388WordPress Tablesome plugin <= 1.0.25 - Cross Site Request Forgery (CSRF) vulnerabilityPauple Table & Contact Form 7 Database – Tablesome
- CVE-2024-31389WordPress MihanPanel plugin < 12.7 - Cross Site Request Forgery (CSRF) vulnerabilityErtano MihanPanel
- CVE-2024-31421WordPress Popup by Supsystic plugin <= 1.10.27 - Broken Access Control vulnerabilityPopup by Supsystic
- CVE-2024-22439Certain HPE FlexNetwork and FlexFabric Switches, Remote Authentication BypassHewlett Packard Enterprise HPE FlexNetwork and FlexFabric p…
- CVE-2024-31422WordPress Favicon by RealFaviconGenerator plugin <= 1.3.29 - Cross Site Request Forgery (CSRF) vulnerabilityPhilippe Bernard Favicon
- CVE-2024-31425WordPress Amelia plugin <= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerabilityTMS Amelia
- CVE-2024-31426WordPress Inline Related Posts plugin <= 3.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityData443 Inline Related Posts
- CVE-2024-31427WordPress Marker.io plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerabilityMarker.io
- CVE-2024-22438HPE OfficeConnect 1820 Network switches, Cross-Site Request Forgery (CSRF)Hewlett Packard Enterprise HPE OfficeConnect 1820 Network s…
- CVE-2024-31428WordPress The Conference theme <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerabilityRara Theme The Conference
- CVE-2024-31429WordPress Sarada Lite theme <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityBlossom Themes Sarada Lite
- CVE-2024-31431WordPress Product Input Fields for WooCommerce plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) vulnerabilityTyche Softwares Product Input Fields for WooCommerce
- CVE-2024-31432WordPress Restrict Content plugin <= 3.2.8 - Broken Access Control vulnerabilityStellarWP Restrict Content
- CVE-2024-31433WordPress The Events Calendar plugin <= 6.3.0 - Cross Site Request Forgery (CSRF) vulnerabilityStellarWP The Events Calendar
- CVE-2024-31434WordPress Newsletter plugin <= 8.0.6 - Cross Site Request Forgery (CSRF) vulnerabilityStefano Lissa & The Newsletter Team Newsletter
- CVE-2024-31920WordPress Currency per Product for WooCommerce plugin <= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerabilityTyche Softwares Currency per Product for WooCommerce
- CVE-2024-31921WordPress Ultimate Product Catalog plugin <= 5.2.15 - Cross Site Request Forgery (CSRF) vulnerabilityEtoile Web Design Ultimate Product Catalogue
- CVE-2024-31922WordPress Hosting Benchmark tool plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) vulnerabilityAnton Aleksandrov WordPress Hosting Benchmark tool
- CVE-2024-31923WordPress Feather Login Page plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerabilityPluginOps Feather Login Page
- CVE-2024-31933WordPress Page Builder: Live Composer plugin <= 1.5.35 - Cross Site Request Forgery (CSRF) vulnerabilityLive Composer Team Page Builder: Live Composer
- CVE-2024-31938WordPress NewsXpress theme <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerabilityThemeinwp NewsXpress
- CVE-2024-31940WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.104 - Cross Site Request Forgery (CSRF) vulnerabilityRedNao Extra Product Options Builder for WooCommerce
- CVE-2024-31941WordPress CP Media Player plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerabilityCodePeople CP Media Player
- CVE-2024-31942WordPress Calendarista Basic Edition plugin <= 3.0.2 - Cross Site Request Forgery (CSRF) vulnerabilitytypps Calendarista Basic Edition
- CVE-2024-32084WordPress Before And After plugin <= 3.9 - Cross Site Request Forgery (CSRF) vulnerabilityGold Plugins Before And After
- CVE-2024-32085WordPress Citadela Listing plugin < 5.20.0 - Cross-Site Request Forgery (CSRF) vulnerabilityAitThemes Citadela Listing
- CVE-2024-32088WordPress Website Builder plugin <= 6.15.20 - Cross Site Request Forgery (CSRF) vulnerabilityComing Soon Page, Under Construction & Maintenance Mode by…
- CVE-2024-32089WordPress Digital Publications by Supsystic plugin <= 1.7.7 - Cross Site Request Forgery (CSRF) vulnerabilityDigital Publications by Supsystic
- CVE-2024-32090WordPress Church Admin plugin <= 4.0.27 - Cross Site Request Forgery (CSRF) vulnerabilityandy_moyle Church Admin
- CVE-2024-32091WordPress Sangar Slider plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerabilityTonjoo Sangar Slider
- CVE-2024-32092WordPress Kimili Flash Embed plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerabilityMichael Bester Kimili Flash Embed
- CVE-2024-32093WordPress Novelist plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerabilityNose Graze Novelist
- CVE-2024-32094WordPress Church Content plugin <= 2.6 - Cross Site Request Forgery (CSRF) vulnerabilityChurchThemes Church Content – Sermons, Events and More
- CVE-2024-32095WordPress MultiParcels Shipping For WooCommerce plugin < 1.16.9 - Cross Site Request Forgery (CSRF) vulnerabilityMultiParcels Shipping For WooCommerce
- CVE-2024-32096WordPress WP Synchro plugin <= 1.11.2 - Cross Site Request Forgery (CSRF) vulnerabilityDAEV.tech WP Migration Plugin DB & Files – WP Synchro
- CVE-2024-32097WordPress GEO my WordPress plugin <= 4.1 - Cross Site Request Forgery (CSRF) vulnerabilityEyal Fitoussi GEO my WordPress
- CVE-2024-32099WordPress WP Mail Catcher plugin <= 2.1.6 - Cross Site Request Forgery vulnerabilityJames Ward WP Mail Catcher
- CVE-2024-32101WordPress Email Marketing for WooCommerce plugin <= 1.14.3 - Cross Site Request Forgery (CSRF) vulnerabilityEmail Marketing for WooCommerce by Omnisend
- CVE-2024-32102WordPress Crony Cronjob Manager plugin <= 0.5.0 - Cross Site Request Forgery (CSRF) vulnerabilityScott Kingsley Clark Crony Cronjob Manager
- CVE-2024-32103WordPress Siteimprove plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerabilitySiteimprove
- CVE-2024-32104WordPress NextMove Lite plugin <= 2.18.1 - Cross Site Request Forgery (CSRF) vulnerabilityXLPlugins NextMove Lite
- CVE-2024-32141WordPress Libsyn Publisher Hub plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) vulnerabilityLibsyn Publisher Hub
- CVE-2024-32433WordPress BEAF plugin <= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerabilityThemefic BEAF
- CVE-2024-32434WordPress Order Delivery Date for WooCommerce plugin <= 3.20.2 - Cross Site Request Forgery (CSRF) vulnerabilityTyche Softwares Order Delivery Date for WooCommerce
- CVE-2024-32435WordPress AffiEasy plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerabilityperrinalexandre05 AffiEasy
- CVE-2024-32436WordPress Gift Cards plugin <= 4.4.0 - Cross Site Request Forgery (CSRF) vulnerabilityCodemenschen Gift Vouchers
- CVE-2024-32437WordPress eCommerce Product Catalog plugin <= 3.3.28 - Cross Site Request Forgery (CSRF) vulnerabilityimpleCode eCommerce Product Catalog
- CVE-2024-32438WordPress SEO Booster plugin <= 3.8.9 - Cross Site Request Forgery (CSRF) vulnerabilitycleverplugins.com SEO Booster
- CVE-2024-32439WordPress WP Client Reports plugin <= 1.0.22 - Cross Site Request Forgery (CSRF) vulnerabilitySwitchWP WP Client Reports
- CVE-2024-32440WordPress Asgaros Forum plugin <= 2.8.0 - Cross Site Request Forgery (CSRF) vulnerabilityThomas Belser Asgaros Forum
- CVE-2024-32441WordPress Zoho Campaigns plugin <= 2.0.7 - Cross Site Request Forgery (CSRF) vulnerabilityZoho Campaigns
- CVE-2024-32442WordPress Zoho Campaigns plugin <= 2.0.7 - Cross Site Request Forgery (CSRF) vulnerabilityZoho Campaigns
- CVE-2024-32443WordPress IP2Location Country Blocker plugin <= 2.34.2 - Cross Site Request Forgery (CSRF) vulnerabilityDownload IP2Location Country Blocker
- CVE-2024-32445WordPress WebinarIgnition plugin <= 3.05.8 - Cross Site Request Forgery (CSRF) vulnerabilitySaleswonder Team: Tobias WebinarIgnition
- CVE-2024-32446WordPress Wallet System for WooCommerce plugin <= 2.5.9 - Cross Site Request Forgery (CSRF) vulnerabilityWP Swings Wallet System for WooCommerce
- CVE-2024-32447WordPress AWP Classifieds plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityAWP Classifieds Team AWP Classifieds
- CVE-2024-32448WordPress Ads.txt Admin plugin <= 1.3 - Cross Site Request Forgery (CSRF) vulnerabilityVideoYield.com Ads.txt Admin
- CVE-2024-32449WordPress RestroPress plugin <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityMagniGenie RestroPress
- CVE-2024-32450WordPress WpTravelly plugin <= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerabilityMagePeople Team WpTravelly
- CVE-2024-32451WordPress Legal Pages plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerabilitywpWax Legal Pages
- CVE-2024-32452WordPress Shopping Cart & eCommerce Store plugin <= 5.5.19 - Cross Site Request Forgery (CSRF) vulnerabilityWP EasyCart
- CVE-2024-3505JFrog Self-Hosted Artifactory Proxy configuration accessible to low-privilege usersJFrog Artifactory Self-Hosted
- CVE-2024-32431WordPress Import Users from CSV plugin <= 1.2 - PHP Object InjectionWP All Import Import Users from CSV
- CVE-2024-32430WordPress ActiveCampaign plugin <= 8.1.14 - Server Side Request Forgery (SSRF) vulnerabilityActiveCampaign
- CVE-2024-32454WordPress Wappointment plugin <= 2.6.0 - Server Side Request Forgery (SSRF) vulnerabilityAppointment Bookings for Zoom GoogleMeet and more – Wappoin…
- CVE-2023-52144WordPress Product Feed Manager plugin <= 7.3.15 - Directory Traversal vulnerabilityRexTheme Product Feed Manager
- CVE-2024-32079WordPress Advanced iFrame plugin <= 2024.2 - Cross Site Scripting (XSS) vulnerabilityMichael Dempfle Advanced iFrame
- CVE-2024-32140WordPress Libsyn Publisher Hub plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerabilityLibsyn Publisher Hub
- CVE-2024-32147WordPress Contact Form Plugin plugin <= 1.1.23 - Cross Site Scripting (XSS) vulnerabilityForm Plugin Team - GhozyLab Easy Contact Form Lite
- CVE-2024-32428WordPress MWW Disclaimer Buttons plugin <= 3.0.2 - Stored Cross Site Scripting (XSS) vulnerabilityMoss Web Works MWW Disclaimer Buttons
- CVE-2024-32429WordPress Remove Footer Credit plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityWPChill Remove Footer Credit
- CVE-2024-32453WordPress POEditor plugin <= 0.9.8 - Cross Site Scripting (XSS) vulnerabilityPOEditor
- CVE-2024-3771PHPGurukul Student Record System edit-subject.php sql injectionPHPGurukul Student Record System
- CVE-2024-3770PHPGurukul Student Record System sql injectionPHPGurukul Student Record System
- CVE-2024-2858Simple Buttons Creator <= 1.04 - Aribtrary Button Deletion via CSRFSimple Buttons Creator
- CVE-2024-2857Simple Buttons Creator <= 1.04 - Unauthenticated Stored XSSSimple Buttons Creator
- CVE-2024-2836Super Socializer < 7.13.64 - Editor+ Stored XSSSocial Share, Social Login and Social Comments Plugin
- CVE-2024-1849WP Customer Reviews < 3.7.1 - Malicious Redirect via HTTP-EQUIV InjectionWP Customer Reviews
- CVE-2024-1846Responsive Tabs < 4.0.7 - Contributor+ Stored XSSResponsive Tabs
- CVE-2024-1754NPS computy <= 2.7.5 - Admin+ Stored XSSNPS computy
- CVE-2024-1746Testimonial Slider < 2.3.8 - Admin+ Stored XSSTestimonial Slider
- CVE-2024-1712Carousel Slider < 2.2.7 - Editor+ Stored XSSCarousel Slider
- CVE-2024-1660Top Bar < 3.0.5 - Admin+ Stored XSSTop Bar
- CVE-2024-1310WooCommerce < 8.6 - Contributor+ Private/Draft Products AccessWooCommerce
- CVE-2024-1307Smart Forms < 2.6.94 - Subscriber+ Edit Entries via Broken Access ControlSmart Forms
- CVE-2024-1306Smart Forms < 2.6.94 - Edit Entries via CSRFSmart Forms
- CVE-2024-1204Meta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field DisclosureMeta Box
- CVE-2024-0902Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product TitleFancy Product Designer
- CVE-2023-7201Everest Backup < 2.2.5 - Admin+ Arbitrary File UploadEverest Backup
- CVE-2023-6067WP User Profile Avatar <= 1.0.1 - Contributor+ Stored XSSWP User Profile Avatar
- CVE-2024-3768PHPGurukul/itsourcecode News Portal search.php sql injectionPHPGurukul News Portal · itsourcecode News Portal
- CVE-2024-3767PHPGurukul News Portal edit-post.php sql injectionPHPGurukul News Portal
- CVE-2024-3776Netvision airPASS - Reflected XSSNetvision airPASS
- CVE-2024-3775aEnrich Technology a+HRD - Argument InjectionaEnrich Technology a+HRD
- CVE-2024-3774aEnrich Technology a+HRD - Exposure of Sensitive DataaEnrich Technology a+HRD
- CVE-2024-3772Regular expression denial of service in Pydantic < 2.4.0Pydantic
- CVE-2020-22540Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive informati
- CVE-2023-45503SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute arbitrary code, cause a denial of service (DoS),
- CVE-2024-24487An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause a denial of service via crafted UDP packet
- CVE-2024-30567An issue in JNT Telecom JNT Liftcom UMS V1.J Core Version JM-V15 allows a remote attacker to execute arbitrary code via the Network Troubles
- CVE-2024-30656An issue in Fireboltt Dream Wristphone BSW202_FB_AAC_v2.0_20240110-20240110-1956 allows attackers to cause a Denial of Service (DoS) via a c
- CVE-2024-30840A Stack Overflow vulnerability in Tenda AC15 v15.03.05.18 allows attackers to cause a denial of service via the LISTEN parameter in the from
- CVE-2024-31497In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a qui
- CVE-2024-31648Cross Site Scripting (XSS) in Insurance Management System v1.0, allows remote attackers to execute arbitrary web scripts or HTML via a craft
- CVE-2024-31649A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via
- CVE-2024-31651A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via
- CVE-2024-31652A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via
- CVE-2024-32489TCPDF before 6.7.4 mishandles calls that use HTML syntax.tecnickcom/tcpdf