CVEs published December 9, 2024
286 CVEs were published on December 9, 2024: 28 critical, 34 high.
- Published
- 286
- Critical
- 28
- High
- 34
- Medium
- 216
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 40
Most affected products
- Synology Router Manager
- 7
- Drupal Core · drupal/core +2
- 5
- Apache Software Foundation Apache Superset · apache-superset
- 3
- Autodesk Revit
- 3
- awesomesupport Awesome Support
- 3
- Dell PowerScale OneFS
- 3
- JFinalCMS
- 3
- SourceCodester Phone Contact Manager System
- 3
- Unifiedtransform
- 3
- WPDeveloper Essential Blocks for Gutenberg
- 3
Critical 28
- CVE-2024-55638Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008Drupal Core · drupal/core +2
- CVE-2024-55637Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007Drupal Core · drupal/core +2
- CVE-2024-55636Drupal core - Less critical - Gadget chain - SA-CORE-2024-006Drupal Core · drupal/core +2
- CVE-2024-8259Unauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management ProgramEryaz Information Technologies NatraCar B2B Dealer Manageme…
- CVE-2024-54215WordPress Revy plugin <= 1.18 - Unauthenticated SQL Injection vulnerabilityroninwp Revy
- CVE-2024-53822WordPress Pie Register Premium plugin < 3.8.3.3 - Arbitrary File Upload vulnerabilityGenetech Pie Register Premium
- CVE-2024-43222WordPress Sweet Date theme <= 3.7.3 - Privilege Escalation vulnerabilitySeventhQueen Sweet Date
- CVE-2023-32117WordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerabilitySoftLab Integrate Google Drive
- CVE-2022-38946Arbitrary File Upload vulnerability in Doctor-Appointment version 1.0 in /Frontend/signup_com.php, allows attackers to execute arbitrary cod
- CVE-2022-38947SQL Injection vulnerability in Flipkart-Clone-PHP version 1.0 in entry.php in product_title parameter, allows attackers to execute arbitrary
- CVE-2024-40583Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials.
- CVE-2024-46455unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.unstructured · github.com/Unstructured-IO/unstructured
- CVE-2024-48956Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to a
- CVE-2024-53441An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack.cookie-encrypter
- CVE-2024-54918Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacher_avatar.php.
- CVE-2024-54920A SQL Injection vulnerability was found in /teacher_signup.php of kashipara E-learning Management System v1.0, which allows remote attackers
- CVE-2024-54921A SQL Injection was found in /student_signup.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute ar
- CVE-2024-54922A SQL Injection was found in /admin/edit_user.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute a
- CVE-2024-54923A SQL Injection vulnerability was found in /admin/edit_teacher.php in kashipara E-learning Management System v1.0, which allows remote attac
- CVE-2024-54924A SQL Injection was found in /admin/edit_content.php in kashipara E-learning Management System v1.0, which allows remote attackers to execut
- CVE-2024-54925A SQL Injection was found in /remove_sent_message.php in kashipara E-learning Management System v1.0, which allows remote attackers to execu
- CVE-2024-54926A SQL Injection vulnerability was found in /search_class.php of kashipara E-learning Management System v1.0, which allows remote attackers t
- CVE-2024-54930Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_student.php.
- CVE-2024-54931A SQL Injection was found in /admin/delete_event.php in kashipara E-learning Management System v1.0, which allows remote attackers to execut
- CVE-2024-54932Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_department.php.
- CVE-2024-54933Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_content.php.
- CVE-2024-54934Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_class.php.
- CVE-2024-55564The POSIX::2008 package before 0.24 for Perl has a potential _execve50c env buffer overflow.
High 34
- CVE-2024-55634Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004Drupal Core · drupal/core +2
- CVE-2024-54151Directus allows unauthenticated access to WebSocket events and operationsdirectus · @directus/api
- CVE-2024-54149Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletionwintercms winter · winter/wn-cms-module
- CVE-2024-11608A maliciously crafted SKP file, when linked or imported into Autodesk Revit, can be used to cause a Heap-based Overflow.Autodesk Revit
- CVE-2024-11454Untrusted Search Path vulnerability in Autodesk RevitAutodesk Revit
- CVE-2024-49600Dell Power Manager (DPM), versions prior to 3.17, contain an improper access control vulnerability.Dell Power Manager
- CVE-2024-53949Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabledApache Software Foundation Apache Superset · apache-superset
- CVE-2024-54219WordPress AIO Contact plugin <= 2.8.1 - Unauthenticated Site-Wide Cross Site Scripting (XSS) vulnerabilitythehp AIO Contact
- CVE-2024-54220WordPress FAT Services Booking plugin <= 5.6 - Subscriber+ Site-Wide Cross Site Scripting (XSS) vulnerabilityroninwp FAT Services Booking
- CVE-2024-53790WordPress Lenxel Core plugin <= 1.2.8 - Local File Inclusion vulnerabilityOgun Labs Lenxel Core for Lenxel(LNX) LMS
- CVE-2024-54226WordPress Country Blocker plugin <= 3.2 - CSRF to Stored XSS vulnerabilitykarlkiesinger Country Blocker
- CVE-2024-54225WordPress Designer plugin <= 1.4.1 - Local File Inclusion vulnerabilitycodegearthemes Designer
- CVE-2023-22701WordPress Ebook Store plugin <= 5.775 - Broken Authentication vulnerabilityShopfiles Ebook Store
- CVE-2023-25714WordPress Quick Paypal Payments plugin <= 5.7.25 - Broken Access Control vulnerabilityFullworks Quick Paypal Payments
- CVE-2023-47698WordPress Japanized For WooCommerce plugin <= 2.6.4 - Multiple Broken Access Control vulnerabilityshohei.tanaka Japanized For WooCommerce
- CVE-2023-48286WordPress Accept Stripe Payments plugin <= 2.0.79 - Broken Access Control vulnerabilitymra13 Stripe Payments
- CVE-2023-49158WordPress LadiApp plugin <= 4.4 - Broken Access Control lead to XSS vulnerabilityBinh Nguyen LadiApp
- CVE-2023-49817WordPress Flexible Woocommerce Checkout Field Editor plugin <= 2.0.1 - Broken Access Control vulnerabilityheoLixfy Flexible Woocommerce Checkout Field Editor
- CVE-2023-49831WordPress RegistrationMagic plugin <= 5.2.3.0 - Broken Access Control vulnerabilityMetagauss RegistrationMagic
- CVE-2023-49856WordPress Smart Forms plugin <= 2.6.84 - Authenticated Arbitrary Options Change VulnerabilityEDGARROJAS Smart Forms
- CVE-2023-51355WordPress MultiVendorX plugin <= 4.0.23 - Broken Access Control vulnerabilityMultiVendorX
- CVE-2024-40582Pentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information.
- CVE-2024-46547A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access
- CVE-2024-50625An issue was discovered in Digi ConnectPort LTS before 1.4.12.
- CVE-2024-50626An issue was discovered in Digi ConnectPort LTS before 1.4.12.
- CVE-2024-50627An issue was discovered in Digi ConnectPort LTS before 1.4.12.
- CVE-2024-50628An issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12.
- CVE-2024-53450RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.
- CVE-2024-54927Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_users.php.
- CVE-2024-54928kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_teacher.php,
- CVE-2024-54929KASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_subject.php.
- CVE-2024-54938A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files
- CVE-2024-55579An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR.
- CVE-2024-55580An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR.
Medium, low and unrated 224
- CVE-2024-9672Reflected XSS in PaperCut MFPaperCut MF
- CVE-2024-55635Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005Drupal Core
- CVE-2024-12393Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003Drupal Core · drupal/core +2
- CVE-2024-12174An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could interceTenable Security Center
- CVE-2024-55601Hugo does not escape some attributes in internal templatesgohugoio hugo · github.com/gohugoio/hugo
- CVE-2024-12369Elytron-oidc-client: oidc authorization code injectionwildfly · Red Hat JBoss Enterprise Application Platform +3
- CVE-2024-12057User credentials recorded in log filesarcinfo PcVue
- CVE-2024-54147Altair GraphQL Client's desktop app does not validate HTTPS certificatesaltair-graphql altair
- CVE-2024-53847Trix vulnerable to Cross-site Scripting on copy & pastebasecamp trix · trix
- CVE-2024-52599Tuleap vulnerable to XSS in the Gantt chart of the tracker pluginEnalean tuleap
- CVE-2024-52586eLabFTW MFA bypasselabftw
- CVE-2024-11268PDF File Parsing Vulnerability in Autodesk RevitAutodesk Revit
- CVE-2024-45760Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper access control vulnerability.Dell OpenManage Server Administrator
- CVE-2024-45761Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability.Dell OpenManage Server Administrator
- CVE-2023-7298Out-of-Bounds Write Vulnerability in in Autodesk Desktop SoftwareAutodesk FBX SDK
- CVE-2024-38485Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability.Dell ECS
- CVE-2024-42426Dell PowerScale OneFS Versions 9.5.0.x through 9.8.0.x contain an uncontrolled resource consumption vulnerability.Dell PowerScale OneFS
- CVE-2024-11991Uninitialized memory access in Motoko incremental garbage collectorInternet Computer Motoko
- CVE-2024-49603Dell PowerScale OneFS Versions 8.2.2.x through 9.9.0.x contain an incorrect specified argument vulnerability.Dell PowerScale OneFS
- CVE-2024-49602Dell PowerScale OneFS Versions 8.2.2.x through 9.8.0.x contain an improper resource unlocking vulnerability.Dell PowerScale OneFS
- CVE-2024-53948Apache Superset: Error verbosity exposes metadata in analytics databasesApache Software Foundation Apache Superset · apache-superset
- CVE-2024-53947Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functionsApache Software Foundation Apache Superset · apache-superset
- CVE-2023-41953WordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerabilityProfilePress Membership Team ProfilePress
- CVE-2024-53814WordPress Analytify plugin <= 5.4.3 - Broken Access Control vulnerabilityAdnan Analytify
- CVE-2024-54218WordPress AIO Contact plugin <= 2.8.1 - Unauthenticated Plugin Settings Change vulnerabilitythehp AIO Contact
- CVE-2024-52385WordPress Team Member – Multi Language Supported Team plugin <= 7.4 - Limited Local File Inclusion vulnerabilitywpmart Team Member
- CVE-2024-52391WordPress Pie Register Premium plugin < 3.8.3.3 - Broken Access Control vulnerabilityGenetech Pie Register Premium
- CVE-2024-52480WordPress Jobify plugin < 4.3.0 - Broken Access Control vulnerabilityAstoundify Jobify
- CVE-2024-53785WordPress Chatter plugin <= 1.0.1 - Broken Access Control vulnerabilityAlexander Volkov Chatter
- CVE-2024-53816WordPress Tutor LMS Elementor Addons plugin <= 2.1.5 - Broken Access Control vulnerabilityThemeum Tutor LMS Elementor Addons
- CVE-2024-54217WordPress ARForms plugin <= 6.4.1 - Subscriber+ Plugin Settings Change vulnerabilityreputeinfosystems ARForms
- CVE-2024-53791WordPress Lenxel Core plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerabilityOgun Labs Lenxel Core for Lenxel(LNX) LMS
- CVE-2024-53798WordPress FloristPress plugin <= 7.3.0 - Nonce Leakage to Broken Access Control vulnerabilityBAKKBONE Australia FloristPress
- CVE-2024-53818WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerabilityWPXPO PostX
- CVE-2024-54247WordPress ABCBiz Addons and Templates for Elementor plugin <= 2.0.2 - Stored Cross Site Scripting (XSS) vulnerabilityABCBiz Addons and Templates for Elementor
- CVE-2024-54253WordPress Xpro Addons For Elementor plugin <= 1.4.6.5 - Cross Site Scripting (XSS) vulnerabilityXpro Elementor Addons
- CVE-2024-54254WordPress Message Filter for Contact Form 7 plugin <= 1.6.3 - Broken Access Control vulnerabilityKofi Mokome Message Filter for Contact Form
- CVE-2024-53819WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.0 - Insecure Direct Object References (IDOR) vulnerabilityBoldGrid Client Invoicing by Sprout Invoices
- CVE-2023-48277WordPress Super Progressive Web Apps plugin <= 2.2.21 - Broken Access Control vulnerabilitySuperPWA Super Progressive Web Apps
- CVE-2024-54227WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerabilityDotstore Minimum and Maximum Quantity for WooCommerce
- CVE-2024-54251WordPress Prodigy Commerce plugin <= 3.1.2 - Broken Access Control vulnerabilityprodigycommerce Prodigy Commerce
- CVE-2024-54224WordPress ElementsReady Addons for Elementor plugin <= 6.4.7 - Cross Site Scripting (XSS) vulnerabilityquomodosoft ElementsReady Addons for Elementor
- CVE-2024-54228WordPress Wot Elementor Widgets plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityWeboccult Technologies Pvt Wot Elementor Widgets
- CVE-2024-54230WordPress Unlock Addons for Elementor plugin <= 2.2.4 - Cross Site Scripting (XSS) vulnerabilityMasud Hasan Unlock Addons for Elementor
- CVE-2024-54232WordPress RRAddons for Elementor plugin <= 1.1.0 - Stored Cross Site Scripting (XSS) vulnerabilityRRDevs RRAddons for Elementor
- CVE-2024-54260WordPress News Kit Elementor Addons plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityblazethemes News Kit Elementor Addons
- CVE-2024-54255WordPress Login Widget With Shortcode plugin <= 6.1.2 - Open Redirection vulnerabilityaviplugins.com Login Widget With Shortcode
- CVE-2024-54223WordPress ARForms plugin <= 1.7.1 - HTML Injection vulnerabilityreputeinfosystems ARForms Form Builder
- CVE-2023-22708WordPress Kraken.io Image Optimizer plugin <= 2.6.7 - Broken Access Control vulnerabilityKarim Salman Kraken.io Image Optimizer
- CVE-2023-23715WordPress JobBoardWP – Job Board Listings and Submissions plugin <= 1.2.2 - IDOR Leading To Job Removal VulnerabilityJobBoardWP – Job Board Listings and Submissions
- CVE-2023-23716WordPress Zendesk Support for WordPress plugin <= 1.8.4 - Broken Access Control vulnerabilityZendesk Support for WordPress
- CVE-2023-23725WordPress Shortcodes by Angie Makes plugin <= 3.46 - Broken Access Control vulnerabilityChris Baldelomar Shortcodes
- CVE-2023-23726WordPress Tickera – WordPress Event Ticketing plugin <= 3.5.1.0 - CSRF Leading To Post Status Change VulnerabilityTickera.com Tickera
- CVE-2023-23814WordPress Calendar Event Multi View plugin <= 1.4.13 - Broken Access Control vulnerabilityCodePeople CP Multi View Event Calendar
- CVE-2023-23823WordPress Enhanced Text Widget plugin <= 1.5.8 - Broken Access Control vulnerabilityClever Widgets Enhanced Text Widget
- CVE-2023-23825WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Import_WPforms vulnerabilityBrainstorm Force Spectra
- CVE-2023-23834WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Activate_Plugin vulnerabilityBrainstorm Force Spectra
- CVE-2023-23868WordPress Cost of Goods for WooCommerce plugin <= 2.8.6 - Broken Access Control vulnerabilityWPFactory Cost of Goods for WooCommerce
- CVE-2023-23886WordPress WP-RecentComments plugin <= 2.2.7 - Broken Access Control vulnerabilitymg12 WP-RecentComments
- CVE-2023-23887WordPress Easy Google Analytics for WordPress plugin <= 1.6.0 - Broken Access Control vulnerabilityShaon Easy Google Analytics for WordPress
- CVE-2023-23893WordPress Simple Giveaways plugin <= 2.48.0 - Broken Access Control vulnerabilityIgor Benic Simple Giveaways
- CVE-2023-23895WordPress WP Time Slots Booking Form plugin <= 1.1.82 - Broken Access Control vulnerabilityCodePeople WP Time Slots Booking Form
- CVE-2023-23975WordPress Quick Event Manager plugin <= 9.7.4 - Broken Access Control vulnerabilityFullworks Quick Event Manager
- CVE-2023-23986WordPress Reviews and Rating – Google My Business plugin <= 4.14 - Broken Access Control vulnerabilityNoah Hearle, Design Extreme Reviews and Rating – Google My…
- CVE-2023-24375WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 - Broken Access Control vulnerabilityminiOrange WordPress Social Login and Register
- CVE-2023-24407WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerabilityWpDevArt Booking calendar, Appointment Booking System
- CVE-2023-25026WordPress PayPal Brasil para WooCommerce plugin <= 1.4.2 - Broken Access Control vulnerabilityPayPal Brasil para WooCommerce
- CVE-2023-25035WordPress Quick Contact Form plugin <= 8.0.3.1 - Broken Access Control vulnerabilityFullworks Quick Contact Form
- CVE-2023-25037WordPress Booking Calendar Contact Form plugin <= 1.2.34 - Broken Access Control vulnerabilityCodePeople Booking Calendar Contact Form
- CVE-2023-25048WordPress Fantastic Content Protector Free plugin <= 2.6 - Broken Access Control vulnerabilityFantastic Plugins Fantastic Content Protector Free
- CVE-2023-25060WordPress Album and Image Gallery plus Lightbox plugin <= 1.6.2 - Broken Access Control vulnerabilityWP OnlineSupport, Essential Plugin Album and Image Gallery…
- CVE-2023-25067WordPress We’re Open! plugin <= 1.45 - Broken Access Control vulnerabilityNoah Hearle, Design Extreme We’re Open!
- CVE-2023-25454WordPress Protected Posts Logout Button plugin <= 1.4.5 - Broken Access Control vulnerabilityNate Reist Protected Posts Logout Button
- CVE-2023-25455WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.6.0 - Arbitrary Content Deletion vulnerabilityminiOrange WordPress Social Login and Register
- CVE-2023-25469WordPress Easy Table of Contents plugin <= 2.0.45.2 - Broken Access Control vulnerabilityMagazine3 Easy Table of Contents
- CVE-2023-25486WordPress Clone plugin <= 2.3.7 - Broken Access Control vulnerabilityMigrate Clone
- CVE-2023-25703WordPress Meta slider and carousel with lightbox plugin <= 1.6.2 - Broken Access Control vulnerabilityWP OnlineSupport, Essential Plugin Meta slider and carousel…
- CVE-2023-25791WordPress Fontiran plugin <= 2.1 - Broken Access Control vulnerabilityCadus Pro Fontiran
- CVE-2023-25959WordPress Apollo13 Framework Extensions plugin <= 1.8.10 - Broken Access ControlApollo13Themes Apollo13 Framework Extensions
- CVE-2023-25966WordPress FileBird plugin <= 5.1.4 - Broken Access Control vulnerabilityNinja Team Filebird
- CVE-2023-25993WordPress Top 10 – Popular posts plugin for WordPress plugin <= 3.2.3 - Broken Access Control vulnerabilityWebberZone Top
- CVE-2023-26520WordPress Advanced Text Widget plugin <= 2.1.2 - Broken Access Control vulnerabilityMax Chirkov Advanced Text Widget
- CVE-2023-26522WordPress WP Repost plugin <= 0.1 - Broken Access Control vulnerabilityOneWebsite WP Repost
- CVE-2023-27428WordPress WP users media plugin <= 4.2.3 - Broken Access Control vulnerabilityDamir Calusic WP users media
- CVE-2023-27449WordPress Total Poll Lite plugin <= 4.8.6 - Broken Access Control vulnerabilityTotalSuite Total Poll Lite
- CVE-2023-27454WordPress Rife Elementor Extensions & Templates plugin <= 1.1.10 - Broken Access Control vulnerabilityApollo13Themes Rife Elementor Extensions & Templates
- CVE-2023-27625WordPress Site Reviews plugin <= 6.5.0 - Broken Access Control vulnerabilityPaul Ryley Site Reviews
- CVE-2023-27626WordPress Stock Ticker plugin <= 3.23.0 - Broken Access Control vulnerabilityAleksandar Urošević Stock Ticker
- CVE-2023-28165WordPress Backup Bank: WordPress Backup Plugin plugin <= 4.0.28 - Broken Access Control vulnerabilityTech Banker Backup Bank: WordPress Backup Plugin
- CVE-2023-28168WordPress WordPress Console plugin <= 0.3.9 - Broken Access Control vulnerabilityJerod Santo WordPress Console
- CVE-2023-28416WordPress Chankhe theme <= 1.0.5 - Authenticated Arbitrary Plugin Activation vulnerabilitySparkle Themes Chankhe
- CVE-2023-28417WordPress Dynamics 365 Integration plugin <= 1.3.12 - Broken Access Control vulnerabilityAlexaCRM Dynamics 365 Integration
- CVE-2023-28532WordPress Real Estate Directory theme <= 1.0.5 - Authenticated Arbitrary Plugin Activationwpdirectorykit.com Real Estate Directory
- CVE-2023-28536WordPress Branded Social Images plugin <= 1.1.0 - Broken Access Control vulnerabilityAcato Branded Social Images
- CVE-2023-28688WordPress TH Variation Swatches plugin <= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerabilityThemeHunk TH Variation Swatches
- CVE-2023-28689WordPress JS Job Manager plugin <= 2.0.0 - Broken Access Control vulnerabilityJoomSky JS Job Manager
- CVE-2023-29173WordPress Product Category Tree plugin <= 2.5 - Broken Access Control vulnerabilityAWESOME TOGI Product Category Tree
- CVE-2023-29237WordPress Remove Duplicate Posts plugin <= 1.3.5 - Broken Access Control vulnerabilityMuhammad Rehman Remove Duplicate Posts
- CVE-2023-29239WordPress LuckyWP Scripts Control plugin <= 1.2.1 - Broken Access Control vulnerabilityLuckyWP Scripts Control
- CVE-2023-29422WordPress Dynamics 365 Integration plugin <= 1.3.13 - Broken Access Control vulnerabilityAlexaCRM Dynamics 365 Integration
- CVE-2023-29429WordPress User Registration plugin <= 2.3.2.1 - Broken Access Control vulnerabilityWPEverest User Registration
- CVE-2023-29431WordPress qTranslate X Cleanup and WPML Import plugin <= 3.0.1 - Broken Access Control vulnerabilityOntheGoSystems qTranslate X Cleanup and WPML Import
- CVE-2023-29433WordPress tencentcloud-cos plugin <= 1.0.7 - Broken Access Control vulnerability腾讯云 tencentcloud-cos
- CVE-2023-30476WordPress Blogger Buzz theme <= 1.2.2 - Broken Access Control vulnerabilitySparkle Themes Blogger Buzz
- CVE-2023-30479WordPress Stamped.io Product Reviews & UGC for WooCommerce plugin <= 2.3.2 - Broken Access Control vulnerabilityStamped.io Product Reviews & UGC for WooCommerce
- CVE-2023-30486WordPress Square theme <= 2.0.0 - Broken Access ControlHashThemes Square
- CVE-2023-30488WordPress Featured Post Creative plugin <= 1.2.7 - Broken Access Control vulnerabilityWP OnlineSupport, Essential Plugin Featured Post Creative
- CVE-2023-30748WordPress Easy Appointments plugin <= 3.10.7 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityNikola Loncar Easy Appointments
- CVE-2023-30783WordPress Smart WooCommerce Search plugin <= 2.5.0 - Broken Access ControlYummyWP Smart WooCommerce Search
- CVE-2023-30870WordPress Sharkdropship for AliExpress Dropship and Affiliate plugin <= 2.2.3 - Multiple Broken Access Control vulnerabilitieswooproductimporter Sharkdropship for AliExpress Dropship an…
- CVE-2023-30873WordPress WP Docs plugin <= 1.9.8 - Broken Access ControlFahad Mahmood WP Docs
- CVE-2023-31073WordPress Shortcode to display post and user data plugin <= 1.2.0 - Broken Access Control vulnerabilityJose Vega Display custom fields in the frontend – Post and…
- CVE-2023-31214WordPress WP Quick Post Duplicator plugin <= 2.0 - Broken Access Control vulnerabilityArul Prasad J WP Quick Post Duplicator
- CVE-2023-32094WordPress Extended Post Status plugin <= 1.0.19 - Broken Access Control vulnerabilityFelix Welberg Extended Post Status
- CVE-2023-32126WordPress SALERT plugin <= 1.2.1 - Broken Access Control vulnerabilityWPoperation SALERT
- CVE-2023-32293WordPress WRC Pricing Tables plugin <= 2.3.7 - Broken Access Control vulnerabilityRealwebcare WRC Pricing Tables
- CVE-2023-32299WordPress Ni WooCommerce Sales Report plugin <= 3.7.3 - Broken Access Control vulnerabilityAnzar Ahmed Ni WooCommerce Sales Report
- CVE-2023-47694WordPress Mini Cart Drawer For WooCommerce plugin <= 4.0.0 - Broken Access Control vulnerabilityappsbd Mini Cart Drawer For WooCommerce
- CVE-2023-47756WordPress Welcome Email Editor plugin <= 5.0.6 - Broken Access Control vulnerabilityDavid Vongries Welcome Email Editor
- CVE-2023-47760WordPress Essential Blocks plugin <= 4.2.0 - Broken Access Control vulnerabilityWPDeveloper Essential Blocks for Gutenberg
- CVE-2023-47761WordPress Simple 301 Redirects by BetterLinks plugin <= 2.0.7 - Broken Access Control vulnerabilityWPDeveloper Simple 301 Redirects by BetterLinks
- CVE-2023-47762WordPress BetterDocs plugin <= 2.5.2 - Broken Access Control vulnerabilityWPDeveloper BetterDocs
- CVE-2023-47763WordPress WP Custom Admin Interface plugin <= 7.31 - Broken Access Control vulnerabilityNorthern Beaches Websites WP Custom Admin Interface
- CVE-2023-47764WordPress Ditty plugin <= 3.1.24 - Broken Access Control vulnerabilitymetaphorcreations Ditty
- CVE-2023-47776WordPress miniorange otp verification plugin <= 4.2.1 - Broken Access Control vulnerabilityminiorange otp verification
- CVE-2023-47780WordPress EasyAzon – Amazon Associates Affiliate Plugin plugin <= 5.1.0 - Broken Access Control vulnerabilityflowdee EasyAzon
- CVE-2023-47793WordPress Acme Fix Images plugin <= 1.0.0 - Broken Access Control vulnerabilityAcme Themes Acme Fix Images
- CVE-2023-47805WordPress WPCafe plugin <= 2.2.22 - Broken Access Control vulnerabilityArraytics WPCafe
- CVE-2023-47820WordPress WP Like Button plugin <= 1.7.0 - Broken Access Control vulnerabilityCRUDLab WP Like Button
- CVE-2023-47822WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 4.10 - Broken Access Control vulnerabilitySonaar Music MP3 Audio Player for Music, Radio & Podcast by…
- CVE-2023-47823WordPress FormCraft – Contact Form Builder for WordPress plugin <= 1.2.7 - Broken Access Control vulnerabilitynCrafts FormCraft
- CVE-2023-47826WordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.3 - Broken Access Control vulnerabilityNicheAddons Restaurant & Cafe Addon for Elementor
- CVE-2023-47830WordPress Live Preview for Contact Form 7 plugin <= 1.2.0 - Broken Access Control vulnerabilityAddons for Contact Form 7 Live Preview for Contact Form
- CVE-2023-47832WordPress SearchIQ plugin <= 4.4 - Broken Access Control vulnerabilitySearchIQ
- CVE-2023-47836WordPress WP Meta and Date Remover plugin <= 2.3.0 - Broken Access Control vulnerabilityprasadkirpekar WP Meta and Date Remover
- CVE-2023-47838WordPress Conditional Fields for Contact Form 7 plugin <= 2.4.1 - Broken Access Control vulnerabilityJules Colle Conditional Fields for Contact Form
- CVE-2023-47841WordPress Analytify plugin <= 5.1.1 - Broken Access Control vulnerabilityAnalytify
- CVE-2023-47847WordPress PayTR Taksit Tablosu plugin <= 1.3.1 - Broken Access Control vulnerabilityPayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. PayTR Taksit T…
- CVE-2023-47849WordPress BlossomThemes Email Newsletter plugin <= 2.2.4 - Broken Access Control vulnerabilityBlossom Themes BlossomThemes Email Newsletter
- CVE-2023-47869WordPress wpForo plugin <= 2.2.5 - Broken Access Control + CSRF vulnerabilitygVectors Team wpForo Forum
- CVE-2023-47871WordPress Contact Form to Any API plugin <= 1.1.6 - Broken Access Control vulnerabilityIT Path Solutions Contact Form to Any API
- CVE-2023-48274WordPress WCMultiShipping plugin <= 2.3.5 - Broken Access Control vulnerabilityMondial Relay WooCommerce - WCMultiShipping WCMultiShipping
- CVE-2023-48287WordPress TextMe SMS plugin <= 1.9.0 - Broken Access Control vulnerabilityMatat Technologies TextMe SMS
- CVE-2023-48324WordPress Awesome Support HelpDesk plugin <= 6.1.4 - Broken Access control vulnerabilityawesomesupport Awesome Support
- CVE-2023-48332WordPress Mail Bank – #1 Mail SMTP Plugin for WordPress plugin <= 4.0.14 - Broken Access Control vulnerabilityVarun Sharma Mail Bank - #1 Mail SMTP Plugin for WordPress
- CVE-2023-48740WordPress Easy Social Feed plugin <= 6.5.1 - Broken Access Control vulnerabilitySajid Javed Easy Social Feed
- CVE-2023-48750WordPress Void Elementor Post Grid Addon for Elementor Page builder plugin <= 2.1.10 - Broken Access Control vulnerabilityvoidthemes Void Elementor Post Grid Addon for Elementor Pag…
- CVE-2023-48774WordPress IdeaPush plugin < 8.58 - Broken Access Control vulnerabilityMartin Gibson IdeaPush
- CVE-2023-48776WordPress canvasio3D Light plugin <= 2.5.0 - Broken Access Control vulnerabilityvirtuellwerk canvasio3D Light
- CVE-2023-48779WordPress 360 Javascript Viewer plugin <= 1.7.11 - Broken Access Control vulnerability3DWeb 360 Javascript Viewer
- CVE-2023-49154WordPress Button Generator – easily Button Builder plugin <= 2.3.8 - Broken Access Control vulnerabilityWow-Company Button Generator – easily Button Builder
- CVE-2023-49156WordPress GoDaddy Email Marketing plugin <= 1.4.3 - Broken Access Control vulnerabilityGoDaddy Email Marketing
- CVE-2023-49167WordPress Database for CF7 plugin <= 1.2.4 - Broken Access Control vulnerabilitycode4life Database for CF7
- CVE-2023-49192WordPress Enhanced Text Widget plugin <= 1.6.3 - Broken Access Control vulnerabilitycl272 Enhanced Text Widget
- CVE-2023-49193WordPress Grow Social plugin <= 1.30.0 - Broken Access Control vulnerabilityNerdPress Hubbub Lite
- CVE-2023-49194WordPress Importify (Dropshipping WooCommerce) plugin <= 1.0.4 - Sensitive Data Exposure vulnerabilityImportify
- CVE-2023-49196WordPress Pagelayer plugin <= 1.7.7 - Broken Access Control vulnerabilityPagelayer Team PageLayer
- CVE-2023-49754WordPress Bulk Edit Post Titles plugin <= 5.0.0 - Broken Access Control vulnerabilityYogesh Pawar Bulk Edit Post Titles
- CVE-2023-49756WordPress Eventin plugin <= 3.3.52 - Authenticated Notice Dismissal VulnerabilityArraytics Eventin
- CVE-2023-49755WordPress Elementor Timeline Widget plugin <= 2.2 - Notice Dismissal VulnerabilityB.M. Rafiul Alam Elementor Timeline Widget
- CVE-2023-49757WordPress Awesome Support plugin <= 6.1.10 - Broken Access Control + CSRF vulnerabilityawesomesupport Awesome Support
- CVE-2023-49758WordPress WP Booking System plugin <= 2.0.19.2 - Broken Access Control vulnerabilityRoland Murg WP Booking System
- CVE-2023-49818WordPress Webflow Pages plugin <= 1.0.8 - Broken Access Control vulnerabilityWebflow Pages
- CVE-2023-49861WordPress Social Media Feather plugin <= 2.1.3 - Broken Access Control vulnerabilitysocialmediafeather Social Media Feather
- CVE-2023-49832WordPress Site Reviews plugin <= 6.10.2 - Broken Access Control vulnerabilityGemini Labs Site Reviews
- CVE-2023-49859WordPress Login With Ajax plugin <= 4.1 - Broken Access Control vulnerabilityMarcus (aka @msykes) Login With Ajax
- CVE-2023-49835WordPress Post Duplicator plugin <= 2.31 - Broken Access Control vulnerabilityMetaphor Creations Post Duplicator
- CVE-2023-49858WordPress Custom Login plugin <= 4.1.0 - Broken Access Control vulnerabilityAustin Custom Login
- CVE-2023-49848WordPress Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy plugin <= 2.1.1 - Broken Access Control vulnerabilityMarc dooder Sharkdropship dropshipping for Aliexpress, eBay…
- CVE-2023-49849WordPress Shortcoder plugin <= 6.3 - Broken Access Control vulnerabilityvaakash Shortcoder
- CVE-2023-49850WordPress WP Simple HTML Sitemap plugin <= 2.7 - Broken Access Control vulnerabilityAshish Ajani WP Simple HTML Sitemap
- CVE-2023-49851WordPress Square Thumbnails plugin <= 1.1.1 - Broken Access Control + CSRF vulnerabilityILMDESIGNS Square Thumbnails
- CVE-2023-49857WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerabilityawesomesupport Awesome Support
- CVE-2023-50373WordPress Alt Manager plugin <= 1.6.1 - Broken Access Control vulnerabilityWPSAAD Alt Manager
- CVE-2023-50375WordPress Translate WordPress – Google Language Translator plugin <= 6.0.19 - Broken Access Control vulnerabilityedo888 Google Language Translator
- CVE-2023-50877WordPress Product Filter by WBW plugin <= 2.5.0 - Broken Access Control vulnerabilitywoobewoo Product Filter by WBW
- CVE-2023-50876WordPress Molongui plugin <= 4.7.3 - Broken Access Control vulnerabilityMolongui
- CVE-2023-50882WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerabilityproperfraction ProfilePress
- CVE-2023-50884WordPress LA-Studio Element Kit for Elementor plugin <= 1.1.5 - Broken Access Control vulnerabilityLA-Studio Element Kit for Elementor
- CVE-2023-50887WordPress User Feedback plugin <= 1.0.10 - Broken Access Control vulnerabilitySyed Balkhi User Feedback
- CVE-2023-50899WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 5.0.2 - Broken Access Control vulnerabilityProduct Catalog Enquiry for WooCommerce by MultiVendorX
- CVE-2023-50903WordPress Metform Elementor Contact Form Builder plugin <= 3.4.0 - Broken Access Control vulnerabilityRoxnor Metform
- CVE-2023-50904WordPress Poll Maker plugin <= 4.8.0 - Broken Access Control vulnerabilityAys Pro Poll Maker
- CVE-2023-51353WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control vulnerabilityPopup by Supsystic
- CVE-2023-51357WordPress Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.0 - Broken Access Control vulnerabilityConversios.io
- CVE-2023-51360WordPress Essential Blocks plugin <= 4.2.0 - Multiple Subscriber+ Broken Access Control vulnerabilityWPDeveloper Essential Blocks for Gutenberg
- CVE-2023-51359WordPress Essential Blocks plugin <= 4.2.0 - Multiple Contributor+ Broken Access Control vulnerabilityWPDeveloper Essential Blocks for Gutenberg
- CVE-2023-51362WordPress myStickyElements plugin <= 2.1.3 - Broken Access Control vulnerabilityPremio My Sticky Elements
- CVE-2023-49845WordPress Redirects plugin <= 1.2.1 - Broken Access Control vulnerabilitymattdeclaire Redirects
- CVE-2024-46901Apache Subversion: mod_dav_svn denial-of-service via control characters in pathsApache Software Foundation Apache Subversion
- CVE-2024-12307Function-Level Access Control Vulnerability Allows Unauthorized Modification of Student Data in UnifiedtransformUnifiedtransform
- CVE-2024-12306Access Control Vulnerabilities Allow Unauthorized Access to User Profiles in UnifiedtransformUnifiedtransform
- CVE-2024-12305Object-Level Access Control Vulnerability Allows Unauthorized Access to Student Grades in UnifiedtransformUnifiedtransform
- CVE-2024-9651Contact Form Plugin by Fluent Forms < 5.2.1 - Admin+ Stored XSSFluent Forms
- CVE-2024-12360code-projects Online Class and Exam Scheduling System class_update.php sql injectioncode-projects Online Class and Exam Scheduling System
- CVE-2024-12359code-projects Admin Dashboard vendor_management.php cross site scriptingcode-projects Admin Dashboard
- CVE-2024-12358WeiYe-Jing datax-web add os command injectionWeiYe-Jing datax-web
- CVE-2024-12357SourceCodester Best House Rental Management System index.php file inclusionSourceCodester Best House Rental Management System
- CVE-2024-53285Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Synology Router Manager
- CVE-2024-53284Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in Synology Router Manager
- CVE-2024-53283Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in SSynology Router Manager
- CVE-2024-53282Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect MAC Filter functionality Synology Router Manager
- CVE-2024-53281Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Network WOL functionality in Synology Synology Router Manager
- CVE-2024-53279Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in SynologySynology Router Manager
- CVE-2024-53280Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route functionalSynology Router Manager
- CVE-2024-12355SourceCodester Phone Contact Manager System ContactBook.cpp adding input validationSourceCodester Phone Contact Manager System
- CVE-2024-12354SourceCodester Phone Contact Manager System User Menu MenuDisplayStart buffer overflowSourceCodester Phone Contact Manager System
- CVE-2024-12353SourceCodester Phone Contact Manager System User Menu MenuDisplayStart input validationSourceCodester Phone Contact Manager System
- CVE-2024-12352TOTOLINK EX1800T cstecgi.cgi sub_40662C stack-based overflowTOTOLINK EX1800T
- CVE-2024-12351JFinalCMS File Content ContentModel.java findPage sql injectionJFinalCMS
- CVE-2024-12350JFinalCMS Template TemplateController.java update command injectionJFinalCMS
- CVE-2024-12349JFinalCMS save cross-site request forgeryJFinalCMS
- CVE-2024-12348Guizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scriptingGuizhou Xiaoma Technology jpress
- CVE-2022-29974AMI (aka American Megatrends) NTFS driver 1.0.0 (fixed in late 2021 or early 2022) has a buffer overflow.
- CVE-2023-43962Cross Site Scripting vulnerability in Xunrui CMS Public Edition v.4.6.1 allows a remote attacker to execute arbitrary code via the project n
- CVE-2024-54919A Stored Cross Site Scripting (XSS ) was found in /teacher_avatar.php of kashipara E-learning Management System v1.0.
- CVE-2024-54935A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message_teacher_to_student.php of kashipara E-learning Management Syste
- CVE-2024-54936A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message.php of Kashipara E-learning Management System v1.0.
- CVE-2024-54937A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files
- CVE-2024-55563Bitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a related issue to CVE-2024-52913.
- CVE-2024-55565nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.nanoid
- CVE-2024-55566ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name derived from an unseeded RNG).
- CVE-2024-55578Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files.
- CVE-2024-55582Oxide before 6 has unencrypted Control Plane datastores.