CVEs published July 21, 2024
78 CVEs were published on July 21, 2024: 2 critical, 9 high.
- Published
- 78
- Critical
- 2
- High
- 9
- Medium
- 67
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- formtools.org Form Tools
- 4
- itsourcecode University Management System
- 4
- Flute CMS
- 3
- ArtistScope CopySafe Web Protection
- 2
- D-Link DSL-225
- 2
- Gargaj wuhu
- 2
- SourceCodester Record Management System
- 2
- ThinkSAAS
- 2
- Unitronics Vision PLC
- 2
- ZhongBangKeJi CRMEB
- 2
Critical 2
High 9
- CVE-2024-6962Tenda O3 formQosSet stack-based overflowTenda O3
- CVE-2024-37459WordPress PayPlus Payment Gateway plugin <= 6.6.8 - Reflected Cross Site Scripting (XSS) vulnerabilityPayPlus Payment Gateway
- CVE-2024-37461WordPress IdeaPush plugin <= 8.65 - Cross Site Scripting (XSS) vulnerabilityMartin Gibson IdeaPush
- CVE-2024-37485WordPress bbPress Notify (No-Spam) plugin <= 2.18.3 - Reflected Cross Site Scripting (XSS) vulnerabilityVinny Alves (UseStrict Consulting) bbPress Notify
- CVE-2024-38781WordPress CopySafe Web Protection plugin <= 3.15 - Reflected Cross Site Scripting (XSS) vulnerabilityArtistScope CopySafe Web Protection
- CVE-2024-6960H2O deserializes ML models without filtering, potentially allowing execution of malicious codeai.h2o:h2o-core
- CVE-2024-37487WordPress WP Directory Kit plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilitywpdirectorykit.com WP Directory Kit
- CVE-2024-37509WordPress MakeCommerce for WooCommerce plugin <= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityMaksekeskus AS MakeCommerce for WooCommerce
- CVE-2024-37559WordPress counterpoint theme <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEchenley Counterpoint
Medium, low and unrated 67
- CVE-2024-37446WordPress Chained Quiz plugin <= 1.3.2.8 - Cross Site Scripting (XSS) vulnerabilityKiboko Labs Chained Quiz
- CVE-2024-37447WordPress PixelYourSite plugin <= 9.6.1.1 - Cross Site Scripting (XSS) vulnerabilityPixelYourSite – Your smart PIXEL (TAG) Manager
- CVE-2024-37449WordPress Slider Revolution plugin <= 6.7.13 - Cross Site Scripting (XSS) vulnerabilityThemePunch OHG Slider Revolution
- CVE-2024-37457WordPress Ultimate Blocks – WordPress Blocks Plugin plugin <= 3.1.9 - Cross Site Scripting (XSS) vulnerabilityUltimate Blocks – Gutenberg Blocks Plugin
- CVE-2024-37460WordPress SuperSaaS – online appointment scheduling plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerabilitySuperSaaS – online appointment scheduling
- CVE-2024-37465WordPress AI Power: Complete AI Pack – Powered by GPT-4 plugin <= 1.8.66 - Cross Site Scripting (XSS) vulnerabilitySenol Sahin GPT3 AI Content Writer
- CVE-2024-37466WordPress Mega Elements plugin <= 1.2.2 - Contributor+ Cross Site Scripting (XSS) vulnerabilityKraftplugins Mega Elements
- CVE-2024-37480WordPress Apollo13 Framework Extensions plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerabilityApollo13Themes Apollo13 Framework Extensions
- CVE-2024-38782WordPress Leaflet Maps Marker plugin <= 3.12.9 - Cross Site Scripting (XSS) vulnerabilityMapsMarker.com e.U. Leaflet Maps Marker
- CVE-2024-38784WordPress Livemesh Addons for Beaver Builder plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerabilityLivemesh Addons for Beaver Builder
- CVE-2024-38785WordPress Gutenverse plugin <= 1.9.2 - Cross Site Scripting (XSS) vulnerabilityJegstudio Gutenverse
- CVE-2024-38786WordPress CoziPress theme <= 1.0.30 - Cross Site Scripting (XSS) vulnerabilityBurgerThemes CoziPress
- CVE-2024-6958itsourcecode University Management System Avatar File st_update.php unrestricted uploaditsourcecode University Management System
- CVE-2024-6957itsourcecode University Management System Login functions.php sql injectionitsourcecode University Management System
- CVE-2024-6956itsourcecode University Management System view_cgpa.php sql injectionitsourcecode University Management System
- CVE-2024-6955SourceCodester Record Management System sort2.php cross site scriptingSourceCodester Record Management System
- CVE-2024-6954SourceCodester Record Management System sort1.php cross site scriptingSourceCodester Record Management System
- CVE-2024-6953itsourcecode Tailoring Management System sms.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-6952itsourcecode University Management System sql injectionitsourcecode University Management System
- CVE-2024-6951SourceCodester Simple Online Book Store System admin_delete.php sql injectionSourceCodester Simple Online Book Store System
- CVE-2024-6961XXE in Guardrails AI when consuming RAIL documentsguardrails-ai
- CVE-2024-6950Prain HTTP POST Request ?import code injectionPrain
- CVE-2024-6949Gargaj wuhu path traversalGargaj wuhu
- CVE-2024-6948Gargaj wuhu Slide Editor slideeditor.php unrestricted uploadGargaj wuhu
- CVE-2024-6947Flute CMS Notification ContentParser.php replaceContent code injectionFlute CMS
- CVE-2024-6946Flute CMS list code injectionFlute CMS
- CVE-2024-6945Flute CMS Avatar Upload Page ImagesController.php unrestricted uploadFlute CMS
- CVE-2024-6944ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserializationZhongBangKeJi CRMEB
- CVE-2024-37488WordPress HelloAsso plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerabilityHelloAsso
- CVE-2024-37489WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerabilityOceanWP Ocean Extra
- CVE-2024-37492WordPress Gutenberg plugin <= 18.6.0 - Cross Site Scripting (XSS) vulnerabilityGutenberg Team Gutenberg
- CVE-2024-37495WordPress Create by Mediavine plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerabilitymischiefmarmot Create by Mediavine
- CVE-2024-37500WordPress Beaver Builder plugin <= 2.8.2.2 - Cross Site Scripting (XSS) vulnerabilityThe Beaver Builder Team Beaver Builder
- CVE-2024-37507WordPress Eventin plugin <= 3.3.57 - Cross Site Scripting (XSS) vulnerabilityThemewinter Eventin
- CVE-2024-37512WordPress NEX-Forms – Ultimate Form Builder plugin <= 8.5.10 - Cross Site Scripting (XSS) vulnerabilityBasix NEX-Forms – Ultimate Form Builder
- CVE-2024-37514WordPress CopySafe Web Protection plugin <= 3.14 - Cross Site Scripting (XSS) vulnerabilityArtistScope CopySafe Web Protection
- CVE-2024-37515WordPress XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerabilityOptemiz XPlainer - WooCommerce Product FAQ
- CVE-2024-37519WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.1.27 - Cross Site Scripting (XSS) vulnerabilityLeap13 Premium Blocks – Gutenberg Blocks for WordPress
- CVE-2024-38436Commugen SOX 365 – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Commugen SOX
- CVE-2024-37521WordPress zBench theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityzwwooooo zBench
- CVE-2024-37522WordPress CC & BCC for Woocommerce Order Emails plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityDario Curasì CC & BCC for Woocommerce Order Emails
- CVE-2024-38435Unitronics Vision PLC - CWE-703: Improper Check or Handling of Exceptional ConditionsUnitronics Vision PLC
- CVE-2024-37523WordPress Login Logo Editor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityAMP-MODE Login Logo Editor
- CVE-2024-38434Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous FunctionUnitronics Vision PLC
- CVE-2024-37536WordPress Easy Custom Code (LESS/CSS/JS) Plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityWeb357 Easy Custom Code (LESS/CSS/JS) – Live editing
- CVE-2024-37537WordPress WS Contact Form plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityUusWeb.ee WS Contact Form
- CVE-2024-37538WordPress Link To Bible plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerabilityThomas Kuhlmann Link To Bible
- CVE-2024-37545WordPress Floating Social Media Links plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityNick Halsey Floating Social Media Links
- CVE-2024-37548WordPress Meks Easy Ads Widget plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerabilityMeks Easy Ads Widget
- CVE-2024-37549WordPress Save as PDF plugin by Pdfcrowd plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerabilitySave as PDF plugin by Pdfcrowd
- CVE-2024-6943ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserializationZhongBangKeJi CRMEB
- CVE-2024-37550WordPress Template Kit – Export plugin <= 1.0.22 - Cross Site Scripting (XSS) vulnerabilityEnvato Template Kit – Export
- CVE-2024-37551WordPress Simple Social Share plugin <= 3.0 - Cross Site Scripting (XSS) vulnerabilityPerials Simple Social Share
- CVE-2024-37552WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerabilityInisev Social Media & Share Icons
- CVE-2024-37556WordPress WordPress Notification Bar plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerabilitySeedProd WordPress Notification Bar
- CVE-2024-37557WordPress WP Cookie Law Info plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilitySoham Web Solution WP Cookie Law Info
- CVE-2024-37558WordPress WPFavicon plugin <= 2.1.1 - Cross-Site Scripting (XSS) vulnerabilityNazmul Hossain Nihal WPFavicon
- CVE-2024-6942ThinkSAAS Admin Panel Security Center anti.php cross site scriptingThinkSAAS
- CVE-2024-6941ThinkSAAS do.php cross site scriptingThinkSAAS
- CVE-2024-6940DedeCMS article_template_rand.php code injectionDedeCMS
- CVE-2024-6939Xinhu RockOA tpl_upload.html okla cross site scriptingXinhu RockOA
- CVE-2024-6938SiYuan PDF PDF.js cross site scriptingSiYuan
- CVE-2024-6937formtools.org Form Tools Import Option List edit.php curl_exec file inclusionformtools.org Form Tools
- CVE-2024-6936formtools.org Form Tools Setting code injectionformtools.org Form Tools
- CVE-2024-6935formtools.org Form Tools User Settings Page cross site scriptingformtools.org Form Tools
- CVE-2024-6934formtools.org Form Tools cross site scriptingformtools.org Form Tools
- CVE-2024-6933LimeSurvey Survey General Settings updatesurveylocalesettings_generalsettings actionUpdateSurveyLocaleSettingsGeneralSettings sql injectionLimeSurvey