CVEs published October 20, 2024
68 CVEs were published on October 20, 2024: 17 critical, 23 high.
- Published
- 68
- Critical
- 17
- High
- 23
- Medium
- 28
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- PHPGurukul Boat Booking System
- 4
- Codezips Sales Management System
- 3
- code-projects Hospital Management System
- 2
- vivek2tamrakar WP REST API FNS
- 2
- WAVLINK WN530H4 · WAVLINK WN530HG4 +1
- 2
- aatmaadhikari Apa Banner Slider
- 1
- aatmaadhikari APA Register Newsletter Form
- 1
- acespritech Social Link Groups
- 1
- anciwasim Back Link Tracker
- 1
- bepitulaz Woostagram Connect
- 1
Critical 17
- CVE-2024-44000WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerabilityLiteSpeed Technologies LiteSpeed Cache
- CVE-2024-49324WordPress Sovratec Case Management plugin <= 1.0.0 - Arbitrary File Upload vulnerabilitysovratecdev Sovratec Case Management
- CVE-2024-49326WordPress Affiliator plugin <= 2.1.3 - Arbitrary File Upload vulnerabilityVasileios Kerasiotis Affiliator
- CVE-2024-49327WordPress Woostagram Connect plugin <= 1.0.2 - Arbitrary File Upload vulnerabilitybepitulaz Woostagram Connect
- CVE-2024-49329WordPress WP REST API FNS plugin <= 1.0.0 - Arbitrary File Upload vulnerabilityvivek2tamrakar WP REST API FNS
- CVE-2024-49330WordPress Nice Backgrounds plugin <= 1.0 - Arbitrary File Upload vulnerabilitybrx8r Nice Backgrounds
- CVE-2024-49331WordPress Property Lot Management System plugin <= 4.2.38 - Arbitrary File Upload vulnerabilityMyriad Solutionz Property Lot Management System
- CVE-2024-49607WordPress WP Dropbox Dropins plugin <= 1.0 - Arbitrary File Upload vulnerabilityredhopit WP Dropbox Dropins
- CVE-2024-49610WordPress photokit plugin <= 1.0 - Arbitrary File Upload vulnerabilityphotokiteditor photokit
- CVE-2024-49332WordPress Giveaway Boost plugin <= 2.1.4 - PHP Object Injection vulnerabilitygiveawayboost Giveaway Boost
- CVE-2024-49624WordPress Advanced Advertising System plugin <= 1.3.1 - PHP Object Injection vulnerabilitysmartdevth Advanced Advertising System
- CVE-2024-49625WordPress SiteBuilder Dynamic Components plugin <= 1.0 - PHP Object Injection vulnerabilitysphoid SiteBuilder Dynamic Components
- CVE-2024-49626WordPress Shipyaari Shipping Management plugin <= 1.2 - PHP Object Injection vulnerabilityPiyush Patel Shipyaari Shipping Management
- CVE-2024-49286WordPress SSV Events plugin <= 3.2.7 - Local File Inclusion to RCE vulnerabilityJeroen Berkvens SSV Events
- CVE-2024-49611WordPress Product Website Showcase plugin <= 1.0 - Arbitrary File Upload vulnerabilitypaxmanpwnz Product Website Showcase
- CVE-2024-49328WordPress WP REST API FNS Plugin plugin <= 1.0.0 - Account Takeover vulnerabilityvivek2tamrakar WP REST API FNS
- CVE-2024-49604WordPress Simple User Registration plugin <= 6.7 - Broken Authentication vulnerabilityN-Media Simple User Registration
High 23
- CVE-2024-49335WordPress GoogleDrive folder list plugin <= 2.2.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilitysh4d0w28 GoogleDrive folder list
- CVE-2024-49605WordPress Community Lite Video Chat plugin <= 2.2 - CSRF to Stored XSS vulnerabilityStefan Nour AVChat Video Chat
- CVE-2024-49629WordPress Endless Posts Navigation plugin <= 2.2.7 - CSRF to Stored XSS vulnerabilityFahad Mahmood Endless Posts Navigation
- CVE-2024-47325WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.7 - SQL Injection vulnerabilityThemeisle MPG
- CVE-2024-49609WordPress Author Discussion plugin <= 0.2.2 - SQL Injection vulnerabilityBrandon White Author Discussion
- CVE-2024-49612WordPress SW Contact Form plugin <= 1.0 - SQL Injection vulnerabilitySanjeev SW Contact Form
- CVE-2024-49613WordPress Simple Code Insert Shortcode plugin <= 1.0 - SQL Injection vulnerabilitydevelopersnote Simple Code Insert Shortcode
- CVE-2024-49614WordPress SermonAudio Widgets plugin <= 1.9.3 - SQL Injection vulnerabilitySermonAudio Widgets
- CVE-2024-49615WordPress SafetyForms plugin <= 1.0.0 - CSRF to SQL Injection vulnerabilityHenrique Rodrigues SafetyForms
- CVE-2024-49616WordPress Rate Own Post plugin <= 1.0 - SQL Injection vulnerabilitynyasro Rate Own Post
- CVE-2024-49617WordPress Back Link Tracker plugin <= 1.0.0 - CSRF to SQL Injection vulnerabilityanciwasim Back Link Tracker
- CVE-2024-49618WordPress MyTweetLinks plugin <= 1.1.1 - SQL Injection vulnerabilityJordan Lyall MyTweetLinks
- CVE-2024-49619WordPress Social Link Groups plugin <= 1.1.0 - SQL Injection vulnerabilityacespritech Social Link Groups
- CVE-2024-49620WordPress FERMA.ru.net plugin <= 1.3.3 - SQL Injection vulnerabilitymrcheck116 FERMA.ru.net
- CVE-2024-44061WordPress EU/UK VAT Manager for WooCommerce plugin <= 2.12.14 - CSRF to Cross Site Scripting (XSS) vulnerabilityWPFactory EU/UK VAT Manager for WooCommerce
- CVE-2024-49621WordPress APA Register Newsletter Form plugin <= 1.0.0 - CSRF to SQL Injection vulnerabilityaatmaadhikari APA Register Newsletter Form
- CVE-2024-49622WordPress Apa Banner Slider plugin <= 1.0.0 - CSRF to SQL Injection vulnerabilityaatmaadhikari Apa Banner Slider
- CVE-2024-49623WordPress Duplicate Title Validate plugin <= 1.0 - SQL Injection vulnerabilityhasan movahed Duplicate Title Validate
- CVE-2024-49608WordPress GERRYWORKS Post by Mail plugin <= 1.0 - Privilege Escalation vulnerabilityGERRYWORKS Post by Mail
- CVE-2024-10194WAVLINK WN530H4/WN530HG4/WN572HG3 Front-End Authentication Page login.cgi Goto_chidx stack-based overflowWAVLINK WN530H4 · WAVLINK WN530HG4 +1
- CVE-2024-49323WordPress All in One Slider plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityShahriar Alam All in One Slider
- CVE-2024-49334WordPress jLayer Parallax Slider plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityUnizoe Web Solutions jLayer Parallax Slider
- CVE-2024-49606WordPress Google Map Locations plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityDotsquaresLtd Google Map Locations
Medium, low and unrated 28
- CVE-2024-49325WordPress Photo Gallery Builder plugin <= 3.0 - Broken Access Control to Notice Dismissal vulnerabilitywpdiscover Photo Gallery Builder
- CVE-2024-47634WordPress CartBounty plugin <= 8.2 - Cross Site Request Forgery (CSRF) vulnerabilityStreamline CartBounty – Save and recover abandoned carts fo…
- CVE-2024-49250WordPress Table of Contents Plus plugin <= 2408 - Cross Site Request Forgery (CSRF) vulnerabilitySyed Balkhi Table of Contents Plus
- CVE-2024-49272WordPress Social Auto Poster plugin <= 5.3.15 - Cross Site Request Forgery (CSRF) vulnerabilitywpweb Social Auto Poster
- CVE-2024-49274WordPress VOD Infomaniak plugin <= 1.5.7 - Cross Site Request Forgery (CSRF) vulnerabilityInfomaniak Network VOD Infomaniak
- CVE-2024-49275WordPress IdeaPush plugin <= 8.69 - Cross Site Request Forgery (CSRF) vulnerabilityNorthern Beaches Websites IdeaPush
- CVE-2024-49290WordPress Cooked Pro plugin < 1.8.0 - Cross Site Request Forgery (CSRF) vulnerabilityGora Tech Cooked Pro
- CVE-2024-49306WordPress WP Content Copy Protection & No Right Click plugin <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerabilitywp-buy WP Content Copy Protection & No Right Click
- CVE-2024-49627WordPress WordPress Image SEO plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerabilityNoor Alam WordPress Image SEO
- CVE-2024-49628WordPress Most And Least Read Posts Widget plugin <= 2.5.18 - Cross Site Request Forgery (CSRF) vulnerabilitywhiletrue Most And Least Read Posts Widget
- CVE-2024-10195Tecno 4G Portable WiFi TR118 SMS Check goform_get_cmd_process sql injectionTecno 4G Portable WiFi TR118
- CVE-2024-48049WordPress Mighty Builder plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityMighty Plugins Mighty Builder
- CVE-2024-49630WordPress WP Education for Elementor plugin <= 1.2.8 - Stored Cross Site Scripting (XSS) vulnerabilityDevItems WP Education
- CVE-2024-49631WordPress Easy Addons for Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityMd Abdul Kader Easy Addons for Elementor
- CVE-2024-10193WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi ping_ddns command injectionWAVLINK WN530H4 · WAVLINK WN530HG4 +1
- CVE-2024-10192PHPGurukul IFSC Code Finder Project search.php cross site scriptingPHPGurukul IFSC Code Finder Project
- CVE-2024-10191PHPGurukul Boat Booking System Booking Details Page book-details.php cross site scriptingPHPGurukul Boat Booking System
- CVE-2024-10173didi DDMQ Console Module improper authenticationdidi DDMQ
- CVE-2024-10171code-projects Blood Bank System massage.php sql injectioncode-projects Blood Bank System
- CVE-2024-10170code-projects Hospital Management System get_doctor.php sql injectioncode-projects Hospital Management System
- CVE-2024-10169code-projects Hospital Management System change-password.php sql injectioncode-projects Hospital Management System
- CVE-2024-10167Codezips Sales Management System deletecustind.php sql injectionCodezips Sales Management System
- CVE-2024-10166Codezips Sales Management System checkuser.php sql injectionCodezips Sales Management System
- CVE-2024-10165Codezips Sales Management System deletecustcom.php sql injectionCodezips Sales Management System
- CVE-2024-10163SourceCodester Sentiment Based Movie Rating System movie_details.php sql injectionSourceCodester Sentiment Based Movie Rating System
- CVE-2024-10162PHPGurukul Boat Booking System Edit Subdomain Details Page edit-subadmin.php sql injectionPHPGurukul Boat Booking System
- CVE-2024-10161PHPGurukul Boat Booking System Update Boat Image Page change-image.php unrestricted uploadPHPGurukul Boat Booking System
- CVE-2024-10160PHPGurukul Boat Booking System BW Dates Report Page bwdates-report-details.php sql injectionPHPGurukul Boat Booking System