CVEs published October 17, 2024
157 CVEs were published on October 17, 2024: 15 critical, 65 high.
- Published
- 157
- Critical
- 15
- High
- 65
- Medium
- 76
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- Microsoft Edge
- 8
- Acronis Cyber Files
- 5
- Elvaco M-Bus Metering Gateway CMe3100
- 4
- ESAFENET CDG
- 4
- cyberlord92 Miniorange OTP Verification with Firebase
- 3
- EmbedThis GoAhead
- 3
- binary-husky/gpt_academic
- 2
- Dell OpenManage Enterprise
- 2
- Gora Tech Cooked Pro
- 2
- Nokia SR OS (7250 IXR, 7450 ESS, 7750 SR, 7950 IXR, VSR), 7…
- 2
Critical 15
- CVE-2024-49217WordPress Adding drop down roles in registration plugin <= 1.1 - Privilege Escalation vulnerabilitymadiriaashish Adding drop down roles in registration
- CVE-2024-49322WordPress Job Board Manager for WordPress plugin <= 1.0 - Privilege Escalation vulnerabilityCodePassenger Job Board Manager for WordPress
- CVE-2024-49246WordPress Ajax Rating with Custom Login plugin <= 1.1 - SQL Injection vulnerabilityanand23 Ajax Rating with Custom Login
- CVE-2024-49305WordPress Customer Email Verification for WooCommerce plugin <= 2.8.10 - SQL Injection vulnerabilityWPFactory Email Verification for WooCommerce
- CVE-2024-49291WordPress Cooked Pro plugin < 1.8.0 - Unauthenticated Arbitrary File Upload vulnerabilityGora Tech Cooked Pro
- CVE-2024-49314WordPress JiangQie Free Mini Program plugin <= 2.5.2 - Arbitrary File Upload vulnerabilityJiangQie Free Mini Program
- CVE-2024-49400Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and argumMeta Tacquito
- CVE-2024-49318WordPress My Reading Library plugin <= 1.0 - PHP Object Injection vulnerabilityScott My Reading Library
- CVE-2024-49397Cross-site Scripting in Elvaco M-Bus Metering Gateway CMe3100Elvaco M-Bus Metering Gateway CMe3100
- CVE-2024-48920PutongOJ: unprivileged users can escalate privileges by constructing requestsacm309 PutongOJ
- CVE-2024-10025Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xxSICK AG SICK CLV6xx · SICK AG SICK Lector6xx +1
- CVE-2024-9263WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.25 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeoverarraytics Timetics – Appointment Booking & Scheduling
- CVE-2024-9863Miniorange OTP Verification with Firebase <= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role Valuecyberlord92 Miniorange OTP Verification with Firebase
- CVE-2024-9862Miniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password Changecyberlord92 Miniorange OTP Verification with Firebase
- CVE-2023-26785MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "cre
High 65
- CVE-2024-43579Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2024-43578Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2024-43566Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2024-10093VSO ConvertXtoDvd ConvertXtoDvd.exe uncontrolled search pathVSO ConvertXtoDvd
- CVE-2024-48924MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflowMessagePack-CSharp · MessagePack
- CVE-2024-49248WordPress Ad Inserter plugin <= 2.7.37 - Reflected Cross Site Scripting (XSS) vulnerabilitySpacetime Ad Inserter
- CVE-2024-49276WordPress Clio Grow plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilitycliogrow Clio Grow
- CVE-2024-49283WordPress CURCY plugin <= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityVillaTheme CURCY
- CVE-2024-49308WordPress Animator – Scroll Triggered Animations plugin <= 3.0.15 - Reflected Cross Site Scripting (XSS) vulnerabilityToast Plugins Animator
- CVE-2024-49309WordPress Digitally theme <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityomarfolghe Digitally
- CVE-2024-49316WordPress Akismet htaccess writer plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityzodiac Akismet htaccess writer
- CVE-2024-7755HMS Networks EWON FLEXY 202 Insufficiently Protected CredentialsHMS Networks EWON FLEXY
- CVE-2024-43997WordPress easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg plugin <= 2.4.14 - Reflected Cross Site Scripting (XSS) vulnerabilityeasy.jobs EasyJobs
- CVE-2024-49220WordPress Cookie Scanner plugin <= 1.1 - CSRF to Stored XSS vulnerabilityNikel Cookie Scanner
- CVE-2024-49221WordPress cSlider plugin <= 2.4.2 - CSRF to Stored XSS vulnerabilityjulian.weinert cSlider
- CVE-2024-49223WordPress CJ Change Howdy plugin <= 3.3.1 - CSRF to Stored XSS vulnerabilityshibulijack CJ Change Howdy
- CVE-2024-49229WordPress Better Author Bio plugin <= 2.7.10.11 - CSRF to Cross Site Scripting (XSS) vulnerabilityarifnezami Better Author Bio
- CVE-2024-49237WordPress Ahmeti Wp Timeline plugin <= 5.1 - CSRF to Stored XSS vulnerabilityAhmeti Wp Timeline
- CVE-2024-49313WordPress VKontakte Wall Post plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityrudestan VKontakte Wall Post
- CVE-2024-49219WordPress RS-Members plugin <= 1.0.3 - Privilege Escalation vulnerabilitythemexpo RS-Members
- CVE-2024-47304WordPress Fluent Support plugin <= 1.8.0 - SQL Injection vulnerabilityShahjahan Jewel Fluent Support
- CVE-2024-47312WordPress Classic Editor and Classic Widgets plugin <= 1.4.1 - SQL Injection vulnerabilityWP Grim Classic Editor and Classic Widgets
- CVE-2024-49244WordPress SV Product Import Export for WooCommerce plugin <= 1.0.0 - SQL Injection vulnerabilityvrinsoft CSV Product Import Export for WooCommerce
- CVE-2024-49297WordPress Zoho CRM Lead Magnet plugin <= 1.7.9.7 - SQL Injection vulnerabilityzohocrm Zoho CRM Lead Magnet
- CVE-2024-49299WordPress Surfer plugin <= 1.5.0.502 - SQL Injection vulnerabilitySurfer
- CVE-2024-49235WordPress Contact Forms, Live Support, CRM, Video Messages plugin <= 1.10.2 - Sensitive Data Exposure vulnerabilityvideowhisper Contact Forms, Live Support, CRM, Video Messag…
- CVE-2024-49285WordPress SSV MailChimp plugin <= 3.1.5 - Local File Inclusion vulnerabilityJeroen Berkvens SSV MailChimp
- CVE-2024-49287WordPress PDF-Rechnungsverwaltung plugin <= 0.0.1 - Local File Inclusion vulnerabilitymh6webentwicklung PDF-Rechnungsverwaltung
- CVE-2024-49317WordPress Point Maker plugin <= 0.1.4 - Local File Inclusion vulnerabilityZIPANG Point Maker
- CVE-2024-49399Missing Authentication for Critical Function in Elvaco M-Bus Metering Gateway CMe3100Elvaco M-Bus Metering Gateway CMe3100
- CVE-2024-49398Unrestricted Upload of File with Dangerous Type in Elvaco M-Bus Metering Gateway CMe3100Elvaco M-Bus Metering Gateway CMe3100
- CVE-2024-49396Insufficiently Protected Credentials in Elvaco M-Bus Metering Gateway CMe3100Elvaco M-Bus Metering Gateway CMe3100
- CVE-2024-9414Cross-site Scripting vulnerability in LCDS LAquis SCADALCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda…
- CVE-2024-6333Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre ProductsXerox AltaLink® B8045 / B8055 / B8065 / B8075 / B8090 |… +13
- CVE-2024-49315WordPress FREE DOWNLOAD MANAGER plugin <= 1.0.0 - Arbitrary File Deletion vulnerabilityCodeFlock FREE DOWNLOAD MANAGER
- CVE-2024-49579In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requestsJetBrains YouTrack
- CVE-2024-48021WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityScott Paterson Contact Form 7 – PayPal & Stripe Add-on
- CVE-2024-48023WordPress Restaurant Reservations Widget plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityrconnect305 Restaurant Reservations Widget
- CVE-2024-48032WordPress Featured Posts with Multiple Custom Groups (FPMCG) plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerabilitysumitsurai Featured Posts with Multiple Custom Groups
- CVE-2023-6729Nokia SR OS: File Access Security VulnerabilityNokia SR OS (7250 IXR, 7450 ESS, 7750 SR, 7950 IXR, VSR), 7…
- CVE-2024-48048WordPress Wsify Widget plugin <= 1.0 - CSRF to Stored XSS vulnerabilityGabbyKhrmon Wsify Widget
- CVE-2024-48043WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - SQL Injection vulnerabilityShortPixel Image Optimizer
- CVE-2024-48024WordPress Keep Backup Daily plugin <= 2.1.3 - Sensitive Data Exposure vulnerabilityFahad Mahmood Keep Backup Daily
- CVE-2024-49320WordPress Encyclopedia / Glossary / Wiki plugin <= 1.7.60 - Cross Site Scripting (XSS) vulnerabilityDennis Encyclopedia / Glossary / Wiki
- CVE-2024-10068OpenSight Software FlashFXP FlashFXP.exe uncontrolled search pathOpenSight Software FlashFXP
- CVE-2024-49389Local privilege escalation due to insecure folder permissions.Acronis Cyber Files
- CVE-2024-49390Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Files
- CVE-2024-9184SendPulse Free Web Push <= 1.3.6 - Unauthenticated Stored Cross-Site ScriptingSendPulse Free Web Push
- CVE-2024-5429Logo Slider < 4.1.0 - Contributor+ Stored XSSLogo Slider
- CVE-2024-9215Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account TakeoverCo-Authors, Multiple Authors and Guest Authors in an Author…
- CVE-2024-9861Miniorange OTP Verification with Firebase <= 3.6.0 - Authentication Bypasscyberlord92 Miniorange OTP Verification with Firebase
- CVE-2024-45766Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code Injection') vulnerabilDell OpenManage Enterprise
- CVE-2024-30875Cross Site Scripting vulnerability in JavaScript Library jquery-ui v.1.13.1 allows a remote attacker to obtain sensitive information and exe
- CVE-2024-33453Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.
- CVE-2024-48192Tenda G3 v15.01.0.5(2848_755)_EN was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to l
- CVE-2024-48629D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the IPAddress paramete
- CVE-2024-48630D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the MacAddress paramet
- CVE-2024-48631D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in
- CVE-2024-48632D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAd
- CVE-2024-48633D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalP
- CVE-2024-48634D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in t
- CVE-2024-48635D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:2/VID param
- CVE-2024-48636D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID param
- CVE-2024-48637D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID param
- CVE-2024-48638D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SubnetMask paramet
Medium, low and unrated 77
- CVE-2024-49023Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2024-43596Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2024-43587Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2024-43580Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2024-43595Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2024-7316Denial of Service (DoS) Vulnerability in Mitsubishi Electric CNC SeriesMitsubishi Electric CNC M800V Series M800VW · Mitsubish… +17
- CVE-2024-49255WordPress Da Reactions plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerabilityDaniele Alessandra Da Reactions
- CVE-2024-49259WordPress Primary Addon for Elementor plugin <= 1.5.8 - Cross Site Scripting (XSS) vulnerabilitynicheaddons Primary Addon for Elementor
- CVE-2024-49261WordPress Arkhe Blocks plugin <= 2.23.0 - Cross Site Scripting (XSS) vulnerabilityRyo Arkhe Blocks
- CVE-2024-49262WordPress Country Flags for Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilitywepic Country Flags for Elementor
- CVE-2024-49263WordPress My Favorites plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityTakashi Matsuyama My Favorites
- CVE-2024-49264WordPress Events Addon for Elementor plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilitynicheaddons Events Addon for Elementor
- CVE-2024-49277WordPress UltraAddons – Elementor Addons plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilitySaiful Islam UltraAddons Elementor Lite
- CVE-2024-49278WordPress Omnipress plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityomnipressteam Omnipress
- CVE-2024-49279WordPress Hyperlink Group Block plugin <= 1.17.5 - Cross Site Scripting (XSS) vulnerabilityDaniel Floeter Hyperlink Group Block
- CVE-2024-49280WordPress Lightbox slider -- Responsive Lightbox Gallery plugin <= 1.10.6 - Cross Site Scripting (XSS) vulnerabilityWeblizar - WordPress Themes & Plugin Lightbox slider – Resp…
- CVE-2024-49281WordPress Click to Chat – WP Support All-in-One Floating Widget plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerabilityNinja Team Click to Chat – WP Support All-in-One Floating W…
- CVE-2024-49282WordPress Responsive Lightbox & Gallery plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerabilitydFactory Responsive Lightbox
- CVE-2024-49288WordPress Email Template Customizer for WooCommerce plugin <= 1.2.9.1 - Cross Site Scripting (XSS) vulnerabilityVillaTheme Email Template Customizer for WooCommerce
- CVE-2024-49289WordPress Cooked Pro plugin < 1.8.0 - Cross Site Scripting (XSS) vulnerabilityGora Tech Cooked Pro
- CVE-2024-49292WordPress Exclusive Addons for Elementor plugin <= 2.7.1 - Cross-Site Scripting vulnerabilityTim Strifler Exclusive Addons Elementor
- CVE-2024-49295WordPress Simple Testimonials Showcase plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityPressTigers Simple Testimonials Showcase
- CVE-2024-49296WordPress Custom Add to Cart Button Label and Link plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerabilityJC Custom Add to Cart Button Label and Link
- CVE-2024-49298WordPress PeproDev Ultimate Invoice plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerabilityPepro Dev. Group PeproDev Ultimate Invoice
- CVE-2024-49301WordPress G Meta Keywords plugin <= 1.4 - Cross Site Scripting (XSS) vulnerabilitySinan Yorulmaz G Meta Keywords
- CVE-2024-49302WordPress WordPress Portfolio Builder – Portfolio Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityportfoliohub WordPress Portfolio Builder – Portfolio Gallery
- CVE-2024-49307WordPress Admin Management Xtended plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerabilitywpseek Admin Management Xtended
- CVE-2024-49310WordPress Themesflat Addons For Elementor plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilitythemesflat-addons-for-elementor
- CVE-2024-49311WordPress Edwiser Bridge plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerabilityWisdmLabs Edwiser Bridge
- CVE-2024-49319WordPress Awesome Contact Form7 for Elementor plugin <= 3.0 - Cross Site Scripting (XSS) vulnerabilityB.M. Rafiul Alam Awesome Contact Form7 for Elementor
- CVE-2024-10099Stored XSS in comfyanonymous/comfyuicomfyanonymous/comfyui
- CVE-2024-10101Stored XSS in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-10100Path Traversal in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-49304WordPress Pinpoint Booking System plugin <= 2.9.9.5.7 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityDOTonPAPER Pinpoint Booking System
- CVE-2024-49284WordPress WP SendFox plugin <= 1.3.1 - Sensitive Data Exposure vulnerabilityBogdanFix WP SendFox
- CVE-2024-49312WordPress Edwiser Bridge plugin <= 3.0.7 - Server Side Request Forgery (SSRF) vulnerabilityWisdmLabs Edwiser Bridge
- CVE-2024-10073flairNLP flair Mode File Loader clustering.py ClusteringModel code injectionflairNLP flair · flair
- CVE-2024-10072ESAFENET CDG EncryptPolicyService.java actionAddEncryptPolicyGroup sql injectionESAFENET CDG
- CVE-2024-10071ESAFENET CDG EncryptPolicyService.java actionUpdateEncryptPolicyEdit sql injectionESAFENET CDG
- CVE-2018-25104CoinGate Plugin Payment callback.php postProcess logic errorCoinGate Plugin
- CVE-2024-10070ESAFENET CDG PolicyPushControlAction.java actionPolicyPush sql injectionESAFENET CDG
- CVE-2024-10069ESAFENET CDG MailDecryptApplicationService.java actionPassMainApplication sql injectionESAFENET CDG
- CVE-2024-47459Substance3D - Sampler | NULL Pointer Dereference (CWE-476)Adobe Substance3D - Sampler
- CVE-2024-9683Quay: quay allows successful authentication with trucated version of the passwordquay · Red Hat Quay
- CVE-2005-10003mikexstudios Xcomic os command injectionmikexstudios Xcomic
- CVE-2024-49580In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosureJetBrains Ktor · io.ktor:ktor-client-core-jvm
- CVE-2024-48022WordPress Shortcode For Elementor Templates plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilitySysBasics Shortcode For Elementor Templates
- CVE-2024-48025WordPress Simple Baseball Scoreboard plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilitydogrow Simple Baseball Scoreboard
- CVE-2024-48036WordPress SKT Blocks plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilitysonalsinha21 SKT Blocks
- CVE-2024-48046WordPress Contact Form by Supsystic plugin <= 1.7.28 - Cross Site Scripting (XSS) vulnerabilityContact Form by Supsystic
- CVE-2023-6728Nokia SR OS: BOF File Encryption VulnerabilityNokia SR OS (7250 IXR, 7450 ESS, 7750 SR, 7950 IXR, VSR), 7…
- CVE-2024-48031WordPress Featured Posts with Multiple Custom Groups (FPMCG) plugin <= 4.0 - Cross-Site Request Forgery (CSRF) vulnerabilitysumitsurai Featured Posts with Multiple Custom Groups
- CVE-2024-48037WordPress Contact Form Widget plugin <= 1.4.2 - CSRF vulnerabilityA WP Life Contact Form Widget
- CVE-2024-48038WordPress wp-Monalisa plugin <= 6.4 - Cross Site Request Forgery (CSRF) vulnerabilitytuxlog wp-Monalisa
- CVE-2024-48047WordPress Linked Variation for WooCommerce plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerabilityRazon Komar Pal Linked Variation for WooCommerce
- CVE-2024-9898Parallax Image <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via dd-parallax Shortcodethehowarde Parallax Image
- CVE-2024-45713SolarWinds Kiwi CatTools Sensitive Information Disclosure VulnerabilitySolarWinds Kiwi CatTools
- CVE-2024-49386Sensitive information disclosure due to spell-jacking.Acronis Cyber Files
- CVE-2024-49391Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Files
- CVE-2024-49392Stored cross-site scripting (XSS) vulnerability on enrollment invitation page.Acronis Cyber Files
- CVE-2024-8920Fonto – Custom Web Fonts Manager <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadvladolaru Fonto – Custom Web Fonts Manager
- CVE-2024-3187This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0.EmbedThis GoAhead
- CVE-2024-9951Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scriptingopajaap WP Photo Album Plus
- CVE-2024-3186CWE-476 NULL Pointer Dereference vulnerability in the evalExpr() function of GoAhead Web Server (version <= 6.0.0) when compiled with the MEEmbedThis GoAhead
- CVE-2024-3184Multiple CWE-476 NULL Pointer Dereference vulnerabilities were found in GoAhead Web Server up to version 6.0.0 when compiled with the ME_GOAEmbedThis GoAhead
- CVE-2024-9213Persian WooCommerce SMS <= 7.0.2 - Reflected Cross-Site Scriptingpersianscript افزونه پیامک ووکامرس Persian WooCommerce SMS
- CVE-2024-9351Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creationwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2024-9352Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creationwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2024-7417Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosurewproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-8719Flexmls® IDX Plugin <= 3.14.22 - Reflected Cross-Site ScriptingFlexmls® IDX Plugin
- CVE-2024-9347The Ultimate WordPress Toolkit – WP Extended <= 3.0.9 - Reflected Cross-Site Scriptingwpextended The Ultimate WordPress Toolkit – WP Extended
- CVE-2024-9940Calculated Fields Form <= 5.2.45 - HTML Injectioncodepeople Calculated Fields Form
- CVE-2024-9240ReDi Restaurant Reservation <= 24.0902 - Reflected Cross-Site Scriptingthecatkin ReDi Restaurant Reservation – Instant Availabilit…
- CVE-2024-45767Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Neutralization of Special Elements used in an SQL Command (Dell OpenManage Enterprise
- CVE-2023-39593Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated pr
- CVE-2024-27766An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function.
- CVE-2024-49593In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor t