CVEs published June 6, 2024
178 CVEs were published on June 6, 2024: 23 critical, 78 high. 1 is now in CISA KEV.
- Published
- 178
- Critical
- 23
- High
- 78
- Medium
- 69
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 59
Most affected products
- lunary-ai/lunary
- 12
- parisneo/lollms-webui
- 10
- mintplex-labs/anything-llm
- 9
- Kofax Power PDF
- 8
- gaizhenbiao/chuanhuchatgpt
- 5
- Luxion KeyShot Viewer
- 5
- zenml-io/zenml · zenml
- 5
- Sonos Era
- 4
- Themesflat Addons For Elementor
- 4
- berriai/litellm · litellm
- 3
Critical 23
- CVE-2024-22074Dynamsoft Service 1.8.1025 through 1.8.2013, 1.7.0330 through 1.7.2531, 1.6.0428 through 1.6.1112, 1.5.0625 through 1.5.3116, 1.4.0618 throu
- CVE-2024-2359Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-2360Path Traversal leading to Remote Code Execution in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-3408Authentication Bypass and RCE in man-group/dtaleman-group/dtale · dtale
- CVE-2024-3429Path Traversal in parisneo/lollmsparisneo/lollms · lollms
- CVE-2024-3149SSRF in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-4320Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-5133Account Takeover via Exposed Recovery Token in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-3234Path Traversal in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt
- CVE-2024-0520Remote Code Execution due to Full Controlled File Write in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2024-2624Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-5128IDOR Vulnerability in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-2362Path Traversal in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-5452RCE via Property/Class Pollution in lightning-ai/pytorch-lightninglightning-ai/pytorch-lightning · pytorch-lightning +1
- CVE-2024-3104Remote Code Execution in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-36736An issue in the oneflow.permute component of OneFlow-Inc.
- CVE-2024-3033Improper Authorization in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-34832Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to
- CVE-2024-36779Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injection via editCategories.php.
- CVE-2024-5675Unreliable data deserialization vulnerability in MentorSummar Software Mentor – Employee Portal
- CVE-2024-36394SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')SysAid
- CVE-2024-36393SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')SysAid
- CVE-2024-5153Startklar Elementor Addons <= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory Deletionwshberlin Startklar Elementor Addons
High 78
- CVE-2023-37539HCL Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerabilityHCL Software Domino Server
- CVE-2024-36774An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- CVE-2023-51847An issue in obgm and Libcoap v.a3ed466 allows a remote attacker to cause a denial of service via thecoap_context_t function in the src/coap_
- CVE-2024-24199smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/dns.c.
- CVE-2024-24198smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/util.c.
- CVE-2024-24195robdns commit d76d2e6 was discovered to contain a misaligned address at /src/zonefile-insertion.c.
- CVE-2024-24194robdns commit d76d2e6 was discovered to contain a NULL pointer dereference via the item->tokens component at /src/conf-parse.c.
- CVE-2023-49441dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.
- CVE-2024-36823The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitiveorg.ninjaframework:ninja-core
- CVE-2024-32752Johnson Controls Software House iSTAR Configuration Utility (ICU) ToolJohnson Controls iSTAR Configuration Utility · Johnson C… +1
- CVE-2024-36730Improper input validation in OneFlow-Inc.
- CVE-2024-5124Timing Attack Vulnerability in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt
- CVE-2024-5328SSRF Vulnerability in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-3150Privilege Escalation in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-36732An issue in OneFlow-Inc.
- CVE-2024-37153Evmos's contract balance not updating correctly after interchain transactionevmos · github.com/evmos/evmos +17
- CVE-2023-45192IBM Engineering Requirements Management DOORS Next XML external entity injectionIBM Engineering Requirements Management DOORS Next
- CVE-2024-5187Arbitrary File Overwrite in download_model_with_test_data in onnx/onnxonnx/onnx · onnx
- CVE-2024-36734Improper input validation in OneFlow-Inc.
- CVE-2024-5130Incorrect Authorization in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-3322Path Traversal in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-36740An issue in OneFlow-Inc.
- CVE-2024-1873Path Traversal and Denial of Service in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-4851SSRF Vulnerability in stangirard/quivrstangirard/quivr
- CVE-2024-1880OS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogptsignificant-gravitas/autogpt
- CVE-2024-5131Improper Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-2928Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2024-5129Privilege Escalation Vulnerability in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-2288CSRF File Upload Vulnerability in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-30373Kofax Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityKofax Power PDF
- CVE-2024-5478Cross-site Scripting (XSS) in SAML metadata endpoint in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-5186Server Side Request Forgery (SSRF) in imartinez/privategptimartinez/privategpt
- CVE-2024-1881Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogptsignificant-gravitas/autogpt
- CVE-2024-5306Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Execution VulnerabilityKofax Power PDF
- CVE-2024-4881Path Traversal in parisneo/lollmsparisneo/lollms · lollms
- CVE-2024-3110Stored XSS leading to admin account takeover in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-5126Improper Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-5552ReDoS in kubeflow/kubeflowkubeflow/kubeflow
- CVE-2024-2548Path Traversal in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-5305Kofax Power PDF PDF File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityKofax Power PDF
- CVE-2024-5304Kofax Power PDF TGA File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityKofax Power PDF
- CVE-2024-5303Kofax Power PDF PSD File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityKofax Power PDF
- CVE-2024-5482SSRF in add_webpage endpoint in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-2914TarSlip Vulnerability in deepjavalibrary/djldeepjavalibrary/djl
- CVE-2024-4325Server-Side Request Forgery (SSRF) in gradio-app/gradiogradio-app/gradio · gradio
- CVE-2024-4941Local File Inclusion in JSON component in gradio-app/gradiogradio-app/gradio · gradio
- CVE-2024-5302Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityKofax Power PDF
- CVE-2024-5301Kofax Power PDF PSD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityKofax Power PDF
- CVE-2024-3504Improper Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-4889Code Injection in berriai/litellmberriai/litellm
- CVE-2024-1879CSRF to RCE in significant-gravitas/autogptsignificant-gravitas/autogpt
- CVE-2024-30369A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation VulnerabilityA10 Thunder ADC
- CVE-2024-30368A10 Thunder ADC CsrRequestView Command Injection Remote Code Execution VulnerabilityA10 Thunder ADC
- CVE-2024-5506Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityLuxion KeyShot Viewer
- CVE-2024-5508Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityLuxion KeyShot Viewer
- CVE-2024-5509Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution VulnerabilityLuxion KeyShot
- CVE-2024-5507Luxion KeyShot Viewer KSP File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityLuxion KeyShot Viewer
- CVE-2024-5269Sonos Era 100 SMB2 Message Handling Use-After-Free Remote Code Execution VulnerabilitySonos Era
- CVE-2024-5267Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Write Remote Code Execution VulnerabilitySonos Era
- CVE-2024-5505NETGEAR ProSAFE Network Management System UpLoadServlet Directory Traversal Remote Code Execution VulnerabilityNETGEAR ProSAFE Network Management System
- CVE-2024-30375Luxion KeyShot Viewer KSP File Parsing Use-After-Free Remote Code Execution VulnerabilityLuxion KeyShot Viewer
- CVE-2024-30374Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityLuxion KeyShot Viewer
- CVE-2024-36737Improper input validation in OneFlow-Inc.
- CVE-2024-3152Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-36745An issue in OneFlow-Inc.
- CVE-2024-36743An issue in OneFlow-Inc.
- CVE-2024-36742An issue in the oneflow.scatter_nd parameter OneFlow-Inc.
- CVE-2024-35178Jupyter server on Windows discloses Windows user password hashjupyter-server jupyter_server · jupyter-server
- CVE-2024-37150Private npm registry support used scope auth token for downloading tarballsdenoland deno
- CVE-2024-36399Kanboard affected by Project Takeover via IDOR in ProjectPermissionControllerkanboard
- CVE-2024-5329Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameterunitecms Unlimited Elements For Elementor
- CVE-2024-28995SolarWinds Serv-U L Directory Transversal VulnerabilitySolarWinds Serv-U
- CVE-2024-4177Host whitelist parser issue in GravityZone Console On-Premise (VA-11554)Bitdefender GravityZone Console On-Premise
- CVE-2024-5179Cowidgets – Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Local File Inclusioncodelessthemes Cowidgets – Elementor Addons
- CVE-2023-6966The Moneytizer <= 9.6.3 - Missing Authorization via multiple AJAX actionslvaudore The Moneytizer
- CVE-2023-6968The Moneytizer <= 9.6.3 - Cross-Site Request Forgery via multiple AJAX actionslvaudore The Moneytizer
- CVE-2024-5324XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Updatexootix Waitlist Woocommerce · xootix OTP Login & Registe… +2
- CVE-2024-33655The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS qu
Medium, low and unrated 77
- CVE-2024-36775A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted pay
- CVE-2024-4013Failure to update BT Mesh Replay Protection Listsilabs.com Gecko SDK
- CVE-2024-22525dnspod-sr 0dfbd37 contains a SEGV.
- CVE-2024-22524dnspod-sr 0dfbd37 is vulnerable to buffer overflow.
- CVE-2024-24192robdns commit d76d2e6 was discovered to contain a heap overflow via the component block->filename at /src/zonefile-insertion.c.
- CVE-2024-36795Insecure permissions in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to access URLs and directories embedded within the fi
- CVE-2024-37154Evmos allows unvested token delegationsevmos · github.com/evmos/evmos +17
- CVE-2024-2965Denial-of-Service in LangChain SitemapLoader in langchain-ai/langchainlangchain-ai/langchain · langchain-community +1
- CVE-2024-5248Improper Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-2032Race Condition Vulnerability in zenml-io/zenmlzenml-io/zenml · zenml
- CVE-2024-3404Improper Access Control in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt
- CVE-2024-5278Unrestricted File Upload leading to RCE in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt
- CVE-2024-36735OneFlow-Inc.
- CVE-2024-3153Uncontrolled Resource Consumption in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-4888Arbitrary File Deletion in BerriAI/litellmberriai/litellm · litellm
- CVE-2024-3095SSRF in Langchain Web Research Retriever in langchain-ai/langchainlangchain-ai/langchain · langchain-community
- CVE-2024-5206Sensitive Data Leakage in sklearn.feature_extraction.text.TfidfVectorizer in scikit-learn/scikit-learnscikit-learn/scikit-learn · scikit-learn
- CVE-2024-2035Improper Authorization in zenml-io/zenmlzenml-io/zenml · zenml
- CVE-2024-3402Stored XSS vulnerability in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt
- CVE-2024-4890Blind SQL Injection in berriai/litellmberriai/litellm · litellm
- CVE-2024-3166Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-2171Stored XSS in zenml-io/zenmlzenml-io/zenml · zenml
- CVE-2024-5225SQL Injection in berriai/litellmberriai/litellm · litellm
- CVE-2024-2213Improper Authentication in zenml-io/zenmlzenml-io/zenml · zenml
- CVE-2024-3102JSON Injection in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-5307Kofax Power PDF AcroForm Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityKofax Power PDF
- CVE-2024-22326IBM System Storage improper authenticationIBM System Storage DS8900F
- CVE-2024-5550Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3h2oai/h2o-3 · h2o
- CVE-2024-2383Clickjacking Vulnerability in zenml-io/zenmlzenml-io/zenml · zenml
- CVE-2024-37364Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensi
- CVE-2024-32873evmos allows transferring unvested tokens after delegationsevmos · github.com/evmos/evmos +17
- CVE-2024-3099Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2024-23793Upload of files outside application directoryOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2024-5268Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Disclosure VulnerabilitySonos Era
- CVE-2024-5256Sonos Era 100 SMB2 Message Handling Integer Underflow Information Disclosure VulnerabilitySonos Era
- CVE-2024-5277Weak Password Recovery Mechanism in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-5127Improper Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-37156TokenController formName not sanitized in hidden inputSuluFormBundle · sulu/form-bundle
- CVE-2024-37152Unauthenticated Access to sensitive settings in Argo CDargoproj argo-cd · github.com/argoproj/argo-cd/v2/server +2
- CVE-2024-36106Argo CD allows authenticated users to enumerate clusters by nameargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2024-5684ID Charger Connect & Pro - JWT-Null-AlgorithmVolkswagen Group Charging GmbH - Elli, EVBox ID Charger Con…
- CVE-2024-5489Wbcom Designs - Custom Font Uploader <= 2.3.4 - Missing Authorization to Font Deletionwbcomdesigns Wbcom Designs – Custom Font Uploader
- CVE-2024-5188Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-5038Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeextendthemes Colibri Page Builder
- CVE-2024-5658CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After UseBorn05 CraftCMS Plugin - Two-Factor Authentication · born05…
- CVE-2024-5657CraftCMS Plugin - Two-Factor Authentication - Password Hash DisclosureBorn05 CraftCMS Plugin - Two-Factor Authentication · born05…
- CVE-2024-5673Cross-Site Scripting in PHP File Manager by DullduskDulldusk PHP File Manager
- CVE-2024-5259MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution <= 4.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameterwcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…
- CVE-2024-5221Qi Blocks <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scriptingqodeinteractive Qi Blocks
- CVE-2024-5665Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposurexootix Login/Signup Popup
- CVE-2024-3049Booth: specially crafted hash can lead to invalid hmac being accepted by booth serverbooth · Red Hat Enterprise Linux
- CVE-2024-0972BuddyPress Members Only <= 3.4.8 - Improper Access Control to Sensitive Information Exposure via REST APIzhuyi BuddyPress Members Only
- CVE-2024-5152ElementsReady Addons for Elementor <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingquomodosoft ElementsReady Addons for Elementor
- CVE-2024-5161Magical Addons For Elementor <= 1.1.39 - Authenticated (Contributor+) Stored Cross-Site Scriptingnalam-1 Magical Addons For Elementor
- CVE-2024-5162WordPress prettyPhoto <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameteribabar PrettyPhoto – Simple Lightbox Plugin
- CVE-2024-1175WP-Recall – Registration, Profile, Commerce & More <= 16.26.6 - Unauthenticated Payment Deletion via delete_paymentwppost WP-Recall – Registration, Profile, Commerce & More
- CVE-2024-5141Rotating Tweets (Twitter widget and shortcode) <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodempntod Rotating Tweets
- CVE-2024-5615Open Graph <= 1.11.2 - Unauthenticated Sensitive Information Exposurewillnorris Open Graph
- CVE-2024-4458Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via URLsThemesflat Addons For Elementor
- CVE-2024-4212Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple WidgetsThemesflat Addons For Elementor
- CVE-2024-5449WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing <= 5.0.4 - Missing Authorizationwppool WP Dark Mode – Improve Accessibility with AI Powered…
- CVE-2024-4459Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget TitlesThemesflat Addons For Elementor
- CVE-2024-4608SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameterartbees SellKit – Funnel builder and checkout optimizer for…
- CVE-2024-4707Materialis Companion <= 1.3.41 - Authenticated (Contributor+) Store Cross-Site Scripting via materialis_contact_form Shortcodehorearadu Materialis Companion
- CVE-2024-2922Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget TagsThemesflat Addons For Elementor
- CVE-2024-4364Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widgetqodeinteractive Qi Addons For Elementor
- CVE-2024-2017Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.7.8 - Missing Authorization to Authenticated (Subscriber+) PHP Object Injectionadamskaat Countdown, Coming Soon, Maintenance – Countdown &…
- CVE-2024-4705Testimonials Widget <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcodej0hnsmith Testimonials Widget
- CVE-2024-2350Clever Addons for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE Widgetszootemplate Clever Addons for Elementor
- CVE-2024-5224Easy Social Like Box – Popup – Sidebar Widget <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodejohnnash1975 Easy Social Like Box – Popup – Sidebar Widget
- CVE-2024-5001Image Hover Effects for Elementor with Lightbox and Flipbox <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag Parametersbiplob018 Image Hover Effects for Elementor with Lightbox a…
- CVE-2024-4194Album and Image Gallery plus Lightbox <= 2.0 - Unauthenticated Arbitrary Shortcode Executionessentialplugin Album and Image Gallery Plus Lightbox
- CVE-2023-6956EasyAzon – Amazon Associates Affiliate Plugin <= 5.1.0 - Reflected Cross-Site Scripting via easyazon-cloaking-localeflowdee EasyAzon – Amazon Associates Affiliate Plugin
- CVE-2024-0910Restrict for Elementor <= 1.0.7 - Protection Mechanism BypassRestrict for Elementor
- CVE-2024-4942Custom Dash <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scriptingdextorlobo Custom Dash
- CVE-2024-5342Simple Image Popup Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodepurvabathe Simple Image Popup Shortcode
- CVE-2024-4788Boostify Header Footer Builder for Elementor <= 1.3.5 - Missing Authorization to Page/Post Creationduongancol Boostify Header Footer Builder for Elementor